SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 31 Oct 2026.
A relative path traversal flaw exists in the mlflow/mlflow repository, the MLflow project's codebase, in versions prior to 2.3.1. An attacker can exploit this weakness by supplying crafted relative paths that escape the intended directory; the attack vector indicates it is reachable over the network, requires no privileges and no user interaction, and has low complexity.
Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
75.2 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
Still affected on this line by CVE-2026-2614 (fixed in 3.10.0, a newer line); CVE-2026-2652 (fixed in 3.10.0, a newer line); CVE-2026-64849 (fixed in 3.15.0, a newer line).
pippip install "mlflow>=2.22.4"
First fixed in 2.3.1 for CVE-2023-2356.
Affected versions
If you run
Upgrade to
All versions before 2.3.1
2.22.4first fix for this CVE: 2.3.1
“Up to” means the second version is the fix and is not affected.