CVE-2023-6831: mlflow/mlflow path traversal via crafted filename

Summary

CVE-2023-6831 is a path traversal flaw, catalogued as CWE-22 and reported through huntr.dev, in the mlflow/mlflow GitHub repository prior to 2.9.2. The source does not describe the attack vector or what an attacker gains beyond the traversal itself.

Mitigation

Patch commit 1da75dfcecd4d169e34809ade55748384e8af6c1 is listed in the references (github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1), and the 2.9.2 version boundary is stated in the title. The source does not otherwise describe the fix.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online