{"data":{"id":"20c0109e-f096-4e45-b9f6-a514cf531565","title":"CVE-2024-8859: A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service…","summary":"CVE-2024-8859 is a path traversal flaw in mlflow/mlflow version 2.15.1. When the dbfs service is configured and mounted to a local directory, concatenating the URL directly into the file protocol enables arbitrary file read, because only the URL's path part is checked while query and parameters are not handled. The issue is tracked as CWE-29 and was published to NVD on 03/20/2025.","solution":"Patch: https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-8859","publishedAt":"2025-03-20T14:15:44.463Z","cveId":"CVE-2024-8859","cweIds":["CWE-29"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.17.0rc0 (fixed: 2.17.0rc0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow/mlflow path traversal in dbfs service via URL file protocol","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02769,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-4rqf-8pfm-p36r"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:13.052Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-27T00:54:05.780Z","daysToFix":-174,"fixCheckedAt":"2026-10-29T21:44:53.076Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.17.0rc0","matchedVersion":"2.17.0rc0","fixReleasedAt":"2024-09-27T00:54:05.780Z","daysToFix":-174,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:52.926Z"}]}}