CVE-2023-3765

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 2.5.0

Description The issue exists due to incorrect restriction of the path name to a directory with limited access in the validate path is safe() function of the MLflow platform. This can allow a remote attacker to disclose protected information or write arbitrary files.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the validate path is safe() function until a patch is available.