MLflow Path Traversal Vulnerability

HOCH 7.5CVE-2023-6909 · BIT-mlflow-2023-6909 · GHSA-5r3q-93q3-f978 · Published 18/12/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
mlflow PyPI	`< 2.9.2`	`2.9.2`
mlflow lfprojects	`< 2.9.2`	`2.9.2`

Description

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

NVD description

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.