CVE-2023-6909: lfprojects mlflow Path Traversal: '\..\filename'
CVSS: 7.5v3.0HighModified
AliasesGHSA-5r3q-93q3-f978BIT-mlflow-2023-6909PYSEC-2023-252
Published 18-12-2023Last modified 02-08-2024
Vulnerability summary
CVE-2023-6909 is a high (CVSS 7.5) Path Traversal: '\..\filename' vulnerability in lfprojects mlflow. EPSS estimates a 89.72% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.0 (CVE.org)EPSS score
89.72%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 18-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
89.72%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 89.72% on 21-09-2026
21-09-202621-10-2026
EPSS score89.72%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Lfprojects1 product
- mlflow< 2.9.2
Mlflow1 product
- mlflow/mlflow≥ unspecified, < 2.9.2
PyPI1 product
- mlflow< 1da75dfcecd4d169e34809ade55748384e8af6c1 | < 2.9.2
3 vendors · 3 products
References
6 links- huntr.com/bounties/11209efb-0f84-482f-add0-587ea6b7e850WEBEVIDENCEFIXExploitPatchThird Party Advisory
- github.com/mlflow/mlflowPACKAGE