CVE-2025-15031

Katalog CVE

CVSS 9.1 · Critical EPSS 0,85%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lfprojects mlflow. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e exploit · mitigasi · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-15031
• https://bugzilla.redhat.com/show_bug.cgi?id=2448912
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15031.json