CVE-2024-1594
highpriority · track · 30EPSS 0.007 · 53 %ileEUUSEPSS · scored 2026-10-23
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-m49c-5c52-6696mlflow vulnerable to Path Traversal2024-04-16ghsa · osvUS
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect.
- BIT-mlflow-2024-1594Local File Read via Path Traversal in mlflow/mlflow2025-02-04vendor · osvUS
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect.
- PYSEC-2026-1655mlflow vulnerable to Path Traversal2026-07-07vendor · osvUS
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-1594/cnnvd
- https://github.com/mlflow/mlflow/releases/tag/v2.11.3Patchcnnvd
- https://huntr.com/bounties/424b6f6b-e778-4a2b-b860-39730d396f3ecnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-1594cnnvd
- https://huntr.com/bounties/424b6f6b-e778-4a2b-b860-39730d396f3eenisa_euvd
- https://huntr.com/bounties/424b6f6b-e778-4a2b-b860-39730d396f3eExploitIssue TrackingThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan