CVE-2025-15031 - CVE House
Back to Database
Status published High CVE-2025-15031

Path Traversal Vulnerability in mlflow/mlflow

Vulnerability Description

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15031

Credits & Attribution

No credits recorded in the NVD database.

References

More from mlflow

View All →
CVE-2025-1474
Weak Password Requirements in mlflow/mlflow
Low 3.8
CVE-2025-1473
CSRF in mlflow/mlflow
Medium 5.4
CVE-2025-15381
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
High 8.1
CVE-2025-15379
Command Injection in mlflow/mlflow
Critical 10
CVE-2025-15036
Path Traversal Vulnerability in mlflow/mlflow
Critical 9.6

Affected Vendor

Affected Software

mlflow/mlflow
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 18th, 2026
Last Modified: July 15th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact