SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 30 Oct 2026.
The MLflow Tracking Server contains a directory traversal flaw in how it handles model file paths, where user-supplied paths are used in file operations without proper validation. An remote, unauthenticated attacker can exploit this to execute arbitrary code in the context of the service account, with no user interaction required and only a high-complexity attack condition.
Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
76.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 11 months after disclosure. No confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
10 related vulnerabilities in the same code over 3 years. The latest fix listed for mlflow is 3.5.0.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
CVE-2023-2780Path Traversal: '\..\filename' in mlflow/mlflow17 May 2023
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Same code patched: environment_variables.py, uri.py (machine-matched)Functions: get, is_local_uricommit fae77a5commit 438a450
CVE-2024-3573Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow16 Apr 2024
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
This CVECVE-2025-11201MLflow Tracking Server Model Creation Directory Traversal Remote…29 Oct 2025
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
Still affected on this line by CVE-2026-2614 (fixed in 3.10.0, a newer line); CVE-2026-2652 (fixed in 3.10.0, a newer line); CVE-2026-64849 (fixed in 3.15.0, a newer line).
2.22.4
“Up to” means the second version is the fix and is not affected.