{"id":"CVE-2023-2780","published":"2023-05-17T00:00:00Z","modified":"2025-01-22T18:03:49Z","title":"Path Traversal: '\\..\\filename' in mlflow/mlflow","vendor":"mlflow","product":"mlflow/mlflow","tier":"tail","description":{"text":"Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.06363,"percentile":0.9364,"provenance":"source"},"cwes":[{"id":"CWE-29","name":"Path Traversal: '..filename'"}],"references":[{"url":"https://huntr.dev/bounties/b12b0073-0bb0-4bd1-8fc2-ec7f17fd7689","tags":[]},{"url":"https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857","tags":[]}],"priority":{"score":30.6,"factors":[{"name":"EPSS percentile","points":18.73},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.86}]},"exploitSources":{"nuclei":[{"id":"CVE-2023-2780","name":"Mlflow <2.3.1 - Local File Inclusion Bypass","severity":"critical","path":"http/cves/2023/CVE-2023-2780.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2780.yaml"}],"provenance":"source"},"vendorSlug":"mlflow","affectedVersions":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[">= unspecified, < 2.3.1"]}],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<2.3.0","<2.3.1"],"patched":["2.3.0","2.3.1"],"from":["GHSA-wjq3-7jxx-whj9","PYSEC-2023-69"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0159","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mlflow-mlflow-cve-2023-2780","children":[{"from":"CVE-2023-2780","to":"CVE-2024-3573","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py","mlflow/server/handlers.py","mlflow/utils/uri.py"],"commits":["https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857","https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc"],"basis":"shared function","functions":["get","is_local_uri"]}]},{"from":"CVE-2023-2780","to":"CVE-2025-11201","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/environment_variables.py","mlflow/server/handlers.py"],"commits":["https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857","https://github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7"],"basis":"shared function","functions":["get"]}]}],"packageHistory":[{"cve":"CVE-2023-1177","published":"2023-03-24","fixed":"2.2.1","kev":false},{"cve":"CVE-2023-1176","published":"2023-03-24","fixed":"2.2.2","kev":false,"link":{"from":"CVE-2023-1176","to":"CVE-2023-2780","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.2.2","toFixed":"2.3.0","daysApart":54}]}},{"cve":"CVE-2023-2356","published":"2023-04-28","fixed":"2.3.1","kev":false},{"cve":"CVE-2023-2780","published":"2023-05-17","fixed":"2.3.1","kev":false},{"cve":"CVE-2023-3765","published":"2023-07-19","fixed":"2.5.0","kev":false,"link":{"from":"CVE-2023-2780","to":"CVE-2023-3765","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.3.1","toFixed":"2.5.0","daysApart":63}]}},{"cve":"CVE-2023-4033","published":"2023-08-01","fixed":"2.6.0","kev":false},{"cve":"CVE-2023-6014","published":"2023-11-16","fixed":"2.8.0","kev":false}],"package":"PyPI:mlflow"}}