Directory Traversal Vulnerability in MLflow Tracking Server

CVE-2025-11201

What is CVE-2025-11201?

A vulnerability exists in MLflow Tracking Server that allows remote attackers to exploit improper validation in model file paths. This oversight can lead to directory traversal attacks, enabling malicious users to execute arbitrary code within the context of the service account. Importantly, this vulnerability can be exploited without authentication, elevating the risk to affected installations. Administrators should take immediate steps to apply the necessary security patch to protect their systems from potential exploits.

References