{"id":"CVE-2025-11201","published":"2025-10-29T19:37:10Z","modified":"2026-02-26T16:56:56Z","title":"MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability","vendor":"MLflow","product":"MLflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"MLflow","product":"MLflow","versions":["2.21.3"]}],"description":{"text":"MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.","provenance":"source","from":"CVE.org"},"summary":{"text":"The MLflow Tracking Server contains a directory traversal flaw in how it handles model file paths, where user-supplied paths are used in file operations without proper validation. An remote, unauthenticated attacker can exploit this to execute arbitrary code in the context of the service account, with no user interaction required and only a high-complexity attack condition.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:36Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.26282,"percentile":0.98,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-30","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - April 2026","url":"https://otx.alienvault.com/pulse/6a04aeed763730d81a39cece","created":"2026-05-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-931/","tags":["x_research-advisory"]},{"url":"https://github.com/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":[">=3.0.0rc0, <3.0.0","<2.22.4"],"patched":["3.0.0","2.22.4"],"from":["GHSA-5cvj-7rg6-jggj","PYSEC-2026-1640"],"provenance":"source"}],"advisories":[{"id":"GHSA-5cvj-7rg6-jggj","url":"https://github.com/advisories/GHSA-5cvj-7rg6-jggj","severity":"HIGH","ecosystem":"PyPI","package":"mlflow","vulnerableRanges":[">=3.0.0rc0, <3.0.0"],"patched":["3.0.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5cvj-7rg6-jggj","url":"https://github.com/advisories/GHSA-5cvj-7rg6-jggj","severity":"HIGH","ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<2.22.4"],"patched":["2.22.4"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-36707","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-36707","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-27","earliestUrl":"https://github.com/rmhowe425/POC-CVE-2025-11201","repos":[{"name":"rmhowe425/POC-CVE-2025-11201","url":"https://github.com/rmhowe425/POC-CVE-2025-11201","stars":0,"created":"2026-09-27"}]},"first":{"date":"2026-09-27","source":"PoC-in-GitHub","url":"https://github.com/rmhowe425/POC-CVE-2025-11201"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-10-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-11201","provenance":"source"},{"date":"2026-09-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rmhowe425/POC-CVE-2025-11201","provenance":"source"}],"speed":{"daysToPublicExploit":333,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":76.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 1 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.6,"detail":"percentile 0.9800"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-mlflow-mlflow-cve-2023-2780","parents":[{"from":"CVE-2023-2780","to":"CVE-2025-11201","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py"],"commits":["https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857","https://github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7"],"basis":"shared function","functions":["get"]}]},{"from":"CVE-2024-3573","to":"CVE-2025-11201","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py"],"commits":["https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc","https://github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7"],"basis":"shared function","functions":["get"]}]},{"from":"CVE-2025-1473","to":"CVE-2025-11201","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py"],"commits":["https://github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7","https://github.com/mlflow/mlflow/commit/ecfa61cb43d3303589f3b5834fd95991c9706628"],"basis":"shared function","functions":["get"]}]}],"children":[{"from":"CVE-2025-11201","to":"CVE-2025-14279","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py"],"commits":["https://github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7","https://github.com/mlflow/mlflow/commit/b0ffd289e9b0d0cc32c9e3a9b9f3843ae83dbec3"],"basis":"shared function","functions":["get"]}]}],"packageHistory":[{"cve":"CVE-2025-1474","published":"2025-03-20","fixed":"2.19.0","kev":false},{"cve":"CVE-2025-1473","published":"2025-03-20","fixed":"2.20.3","kev":false},{"cve":"CVE-2025-11200","published":"2025-10-29","fixed":"2.22.0rc0","kev":false},{"cve":"CVE-2025-11201","published":"2025-10-29","fixed":"3.0.0","kev":false},{"cve":"CVE-2025-52967","published":"2025-06-23","fixed":"3.1.0","kev":false,"link":{"from":"CVE-2025-52967","to":"CVE-2025-11201","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.22.2","toFixed":"2.22.4","daysApart":128}]}},{"cve":"CVE-2025-10279","published":"2026-02-02","fixed":"3.4.0rc0","kev":false},{"cve":"CVE-2025-14279","published":"2026-01-12","fixed":"3.5.0","kev":false}],"package":"PyPI:mlflow"}}