MLflow allowed arbitrary files to be PUT onto the server

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2023-6015 · ADVISORY
• mlflow/mlflow#10330 · WEB
• mlflow/mlflow commit cf83dad · WEB
• mlflow/mlflow · PACKAGE
• huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3 · WEB
• pypi.org/project/mlflow · PACKAGE
• GitHub Advisory GHSA-f798-qm4r-23r5 · ADVISORY

Lỗ hổng khác của mlflow

• CVE-2026-116692NGHIÊM TRỌNG 9.8MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0…
• CVE-2026-116691TRUNG BÌNH 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, m…
• CVE-2026-116690CAO 7.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, t…
• CVE-2026-115886TRUNG BÌNH 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0…
• CVE-2026-53995CAO 8.2MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to…