Arbitrary File Write Vulnerability in MLflow by Databricks
CVE-2025-15031
What is CVE-2025-15031?
A vulnerability in the pyfunc extraction process of MLflow allows for arbitrary file writes. The improper handling of tar archive entries, particularly the use of tarfile.extractall without proper path validation, permits maliciously crafted tar.gz files to exploit the system. This can result in files being extracted outside the intended directory, escaping potential safeguards. This issue is particularly concerning in multi-tenant environments or when dealing with untrusted artifacts, as it could lead to unwanted file overwrites or even enable remote code execution.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
mlflow/mlflow <= unspecified