CVE-2023-3765: MLflow absolute path traversal before 2.5.0

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 10.0 with network reachability, no authentication, no user interaction, and high EPSS plus an exploit-tagged reference make this an urgent patching priority.

What it is

MLflow versions prior to 2.5.0 contain an absolute path traversal flaw (CWE-36) in the GitHub repository mlflow/mlflow. The vulnerability allows an unauthenticated remote attacker to reach files outside the intended directory, and the CVSS 3.1 score is 10.0 (critical) with scope change, high confidentiality, integrity, and availability impact.

Impact

An attacker can read, modify, or delete files outside the intended directory, potentially leading to full compromise of the MLflow service and its host. The scope change in the CVSS vector indicates impact can extend beyond the vulnerable component.

Attack surface

The flaw is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N) required, based on the CVSS vector. No further product or endpoint details are provided in the record.

Exploitation

The record is not listed in CISA KEV, but EPSS is 0.6755 (99.276th percentile), and references include an Exploit tag, indicating public exploit code or a detailed advisory is available.

What to do

• Upgrade MLflow to version 2.5.0 or later, which contains the patch commit 6dde93758d42455cb90ef324407919ed67668b9b.
• If immediate upgrade is not possible, restrict network access to MLflow services to trusted users and networks.
• Run MLflow with least privilege and avoid exposing it directly to the internet.
• Monitor for and block path traversal patterns in requests to MLflow endpoints.
• Review file system permissions for directories accessible by the MLflow process.

Detection

• Inspect MLflow access logs for requests containing absolute paths or traversal sequences such as ../ or encoded variants.
• Monitor file system events for unexpected reads, writes, or deletions outside the MLflow working directory.
• Use network detection to flag anomalous requests to MLflow endpoints that include file path parameters.
• Correlate EPSS and exploit availability with internal exposure to prioritize patching and monitoring.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.