UpHeron
All vulnerabilities

Servers and applications

CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation…

Severity
Critical 9.8
Published
29 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2025-06-10
Sources
NVD

Affected software

SoftwareAffected versions
MLflowServers and applications · cpe:a:lfprojects:mlflow
  • Every version before 2025-06-10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-11201
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11201