CVE-2024-1560 - CVE House
Back to Database
Status published High CVE-2024-1560

Path Traversal Vulnerability in mlflow/mlflow

Vulnerability Description

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler and `local_file_uri_to_path` function, allowing for the deletion of arbitrary directories on the server's filesystem. This vulnerability is due to an extra unquote operation in the `delete_artifacts` function of `local_artifact_repo.py`, which fails to properly sanitize user-supplied paths. The issue is present up to version 2.9.2, despite attempts to fix a similar issue in CVE-2023-6831.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1560

Credits & Attribution

No credits recorded in the NVD database.

References

More from mlflow

View All →
CVE-2025-1474
Weak Password Requirements in mlflow/mlflow
Low 3.8
CVE-2025-1473
CSRF in mlflow/mlflow
Medium 5.4
CVE-2025-15381
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
High 8.1
CVE-2025-15379
Command Injection in mlflow/mlflow
Critical 10
CVE-2025-15036
Path Traversal Vulnerability in mlflow/mlflow
Critical 9.6

Affected Vendor

Affected Software

mlflow/mlflow
Vulnerable Versions:
unspecified

Timeline

Official Publish: April 16th, 2024
Last Modified: August 9th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact