CVE-2025-15036
A path traversal vulnerability exists in the function within the file of the mlflow/mlflow repository.
Published Mar 30, 2026 · updated Jul 15, 2026 · lfprojects mlflow
A path traversal vulnerability exists in the function within the file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2026 · NIST NVD
Detected
A path traversal vulnerability exists in the function within the file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox direct
Jul 15, 2026 · NIST NVD
Updated
A path traversal vulnerability exists in the function within the file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox direct
Affected
- cpe lfprojects/mlflowversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-15036
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-15036
A path traversal vulnerability exists in the function within the file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member pa
nvd.nist.gov