{"id":"CVE-2025-52967","published":"2025-06-23T00:00:00Z","modified":"2025-06-23T20:12:52Z","title":"gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation","vendor":"lfprojects","product":"MLflow","tier":"tail","description":{"text":"gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00438,"percentile":0.38,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/mlflow/mlflow/pull/15970","tags":[]},{"url":"https://github.com/mlflow/mlflow/issues/15944","tags":[]},{"url":"https://github.com/mlflow/mlflow/releases/tag/v3.1.0","tags":[]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":7.6},{"name":"CVSS severity","points":4.06}]},"vendorSlug":"lfprojects","affectedVersions":[{"vendor":"lfprojects","product":"MLflow","versions":["< 3.1.0"]}],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":[">=3.0.0rc0, <3.1.0","<2.22.2","<3.1.0"],"patched":["3.1.0","2.22.2"],"from":["GHSA-wxj7-3fx5-pp9m","PYSEC-2025-52"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-18888","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-1473","published":"2025-03-20","fixed":"2.20.3","kev":false},{"cve":"CVE-2025-11200","published":"2025-10-29","fixed":"2.22.0rc0","kev":false},{"cve":"CVE-2025-11201","published":"2025-10-29","fixed":"3.0.0","kev":false,"link":{"from":"CVE-2025-52967","to":"CVE-2025-11201","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.22.2","toFixed":"2.22.4","daysApart":128}]}},{"cve":"CVE-2025-52967","published":"2025-06-23","fixed":"3.1.0","kev":false},{"cve":"CVE-2025-10279","published":"2026-02-02","fixed":"3.4.0rc0","kev":false,"link":{"from":"CVE-2025-52967","to":"CVE-2025-10279","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"3.1.0","toFixed":"3.4.0rc0","daysApart":224}]}},{"cve":"CVE-2025-14279","published":"2026-01-12","fixed":"3.5.0","kev":false},{"cve":"CVE-2025-14287","published":"2026-03-15","fixed":"3.8.0rc0","kev":false}],"package":"PyPI:mlflow"}}