PT-2025-12247 · Mlflow · Mlflow

Published 2025-03-20 · Updated 2025-08-06 · CVE-2024-8859

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version 2.15.1

Description A path traversal issue exists when users configure and use the dbfs service. The vulnerability arises from directly concatenating the URL into the file protocol, resulting in an arbitrary file read issue. This occurs because only the path part of the URL is checked, while other parts like query and parameters are not handled. The issue is triggered when the dbfs service is configured and mounted to a local directory during usage.

Recommendations For mlflow/mlflow version 2.15.1, consider disabling the dbfs service until a patch is available to prevent potential exploitation. Restrict access to the dbfs service to minimize the risk of arbitrary file read. Avoid using the dbfs service with local directory mounts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

BIT-MLFLOW-2024-8859

CVE-2024-8859

GHSA-4RQF-8PFM-P36R

Affected Products

Mlflow

References · 9

• 🔥 https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb · Exploit
• https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 · Patch
• https://osv.dev/vulnerability/BIT-mlflow-2024-8859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4rqf-8pfm-p36r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8859 · Security Note
• https://github.com/mlflow/mlflow · Note
• https://t.me/cveNotify/130946 · Telegram Post
• https://twitter.com/CVEnew/status/1902968861240316202 · Twitter Post