{"data":{"id":"7da3be13-89c1-42b1-a760-758069d6e191","title":"CVE-2023-3765: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.","summary":"CVE-2023-3765 is an Absolute Path Traversal vulnerability in the GitHub repository mlflow/mlflow prior to 2.5.0, classified as CWE-36. The flaw was reported through huntr.dev, and NVD published the entry on 07/18/2023. NVD has not yet provided an assessment of the vulnerability.","solution":"The source links a patch at https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b, but it does not state a fixed version or describe the fix in its text.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-3765","publishedAt":"2023-07-19T05:15:10.847Z","cveId":"CVE-2023-3765","cweIds":["CWE-36"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.5.0 (fixed: 2.5.0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow/mlflow absolute path traversal","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.6755,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-fmxj-6h9g-6vw3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:52.980Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-07-17T08:14:53.636Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:46:56.362Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.5.0","matchedVersion":"2.5.0","fixReleasedAt":"2023-07-17T08:14:53.636Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:56.212Z"}]}}