CVE-2024-2928
highpriority · attend · 48EPSS 0.218 · 98 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- rain321654/sjtu_CVE-2024-2928yasa扫描sjtu_CVE-2024-2928漏洞报告PoC · poc_in_github
affected products (4)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-j46q-5pxx-8vmwLocal File Inclusion in mlflow2024-06-06ghsa · osvUS
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
- BIT-mlflow-2024-2928Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow2024-10-13vendor · osvUS
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
- PYSEC-2024-2422024-06-06vendor · osvUS
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-2928/cnnvd
- https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07cnnvd
- https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298cnnvd
- https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07enisa_euvd
- https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298enisa_euvd
- https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07Patchnvd
- https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298ExploitIssue TrackingPatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan