Path traversal vulnerability in MLflow (CVE-2024-8859)
A path traversal vulnerability in MLflow's model version source validation was fixed by improving checks to reject relative path sequences like \"..\" that could bypass security controls.
What happened
A path traversal vulnerability was identified in MLflow's validation logic for model version sources. The vulnerability allowed attackers to bypass source validation checks using relative path sequences.
Governance controls
MLflow improved the `_validate_non_local_source_contains_relative_paths` function to reject sources containing relative path traversal sequences. The fix added a check to reject any source containing ".." path components in addition to existing null byte validation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.