{"data":{"id":"5e1eb6e5-cdf1-435a-92bd-79cc67e2e19f","title":"CVE-2023-1176: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.","summary":"CVE-2023-1176 is an Absolute Path Traversal flaw (CWE-36) in the GitHub repository mlflow/mlflow prior to 2.2.2. The source was reported by huntr.dev and the NVD published the entry on 03/24/2023. The source text does not describe what an attacker can access or any preconditions.","solution":"Patch commit: https://github.com/mlflow/mlflow/commit/63ef72aa4334a6473ce7f889573c92fcae0b3c0d","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-1176","publishedAt":"2023-03-24T19:15:10.110Z","cveId":"CVE-2023-1176","cweIds":["CWE-36"],"cvssScore":"3.3","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@<= 2.2.0 (fixed: 2.2.1)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow/mlflow absolute path traversal","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00583,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-wp72-7hj9-5265"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:17.193Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-03-02T21:34:27.351Z","daysToFix":-22,"fixCheckedAt":"2026-10-29T21:47:24.791Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.2.1","matchedVersion":"2.2.1","fixReleasedAt":"2023-03-02T21:34:27.351Z","daysToFix":-22,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:24.641Z"}]}}