{"data":{"id":"c39bc197-4a59-4f65-a516-12e5d13aed32","title":"CVE-2023-2780: Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.","summary":"CVE-2023-2780 is a path traversal flaw, identified by CWE-29 and using the '\\..\\filename' pattern, in the mlflow/mlflow GitHub repository prior to 2.3.1. The NVD assessment has not yet been provided, and the source gives no further detail on how the flaw is reached or what an attacker gains.","solution":"Patch: https://github.com/mlflow/mlflow/commit/fae77a525dd908c56d6204a4cef1c1c75b4e9857","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-2780","publishedAt":"2023-05-18T01:15:09.470Z","cveId":"CVE-2023-2780","cweIds":["CWE-29"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.3.0 (fixed: 2.3.0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow path traversal via crafted filename using backslash sequences","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.06363,"epssCheckedAt":"2026-11-04T18:09:12.971Z","kevDateAdded":null,"advisoryAliases":["GHSA-wjq3-7jxx-whj9"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:59.534Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-04-18T23:17:13.523Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:47:02.638Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.3.0","matchedVersion":"2.3.0","fixReleasedAt":"2023-04-18T23:17:13.523Z","daysToFix":-30,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:02.488Z"}]}}