CVE-2024-8859 json
Path Traversal in mlflow/mlflow
published 2025-03-20 19 mo ago modified 2026-09-08 2 mo ago also BIT-mlflow-2024-8859 , EUVD-2025-6887 , GHSA-4rqf-8pfm-p36r , PYSEC-2026-1638
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.8%
- EPSS 2.8% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.
Patch / fix
- pypi mlflow 2.17.0rc0
- bitnami mlflow 2.16.0
- mlflow mlflow/mlflow 2.17.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
2.77% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Mlflow < 2.17.0 - Local File Inclusion nuclei detection template
- huntr.com https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mlflow | <2.17.0rc0 |
2.17.0rc0 |
| bitnami | mlflow | >=2.15.1, <2.16.0 |
2.16.0 |
Affected products
- mlflow mlflow/mlflow
Classification
References
-
github.com
/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654
web, patch
-
huntr.com
/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb
web, exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-8859
advisory, web
-
github.com
/mlflow/mlflow
package
-
pypi.org
/project/mlflow
package
-
github.com
/advisories/GHSA-4rqf-8pfm-p36r
advisory
Sources
- CVE List CVE-2024-8859
- GitHub Advisory GHSA-4rqf-8pfm-p36r
- NVD CVE-2024-8859
- OSV BIT-mlflow-2024-8859
- OSV PYSEC-2026-1638
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.