CVE-2025-11201 in the critical feed json
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
published last yr. modified 23d ago also BIT-mlflow-2025-11201 , EUVD-2025-36707 , GHSA-5cvj-7rg6-jggj , PYSEC-2026-1640
- cvss
- 8.1
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 28.2%
- EPSS 28.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Patch / fix
- pypi mlflow 2.22.4, 3.0.0
- bitnami mlflow 3.0.0
- lfprojects mlflow 2025-06-10
Is CVE-2025-11201 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
28.20% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mlflow | >=3.0.0rc0, <3.0.0 <2.22.4 |
3.0.0 2.22.4 |
| bitnami | mlflow | <3.0.0 |
3.0.0 |
Affected products
- MLflow MLflow
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161
vendor-advisory, web, patch
-
github.com
/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7
web
-
github.com
/mlflow/mlflow/commit/e7dc0574fa3459e0003cfeb68d4e4a625491f03d
web
-
zerodayinitiative.com
/advisories/ZDI-25-931/
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-11201
advisory, web
-
github.com
/mlflow/mlflow
package
-
zerodayinitiative.com
/advisories/ZDI-25-931
web
-
pypi.org
/project/mlflow
package
-
github.com
/advisories/GHSA-5cvj-7rg6-jggj
advisory
Sources
- CVE List CVE-2025-11201
- GitHub Advisory GHSA-5cvj-7rg6-jggj
- NVD CVE-2025-11201
- OSV BIT-mlflow-2025-11201
- OSV PYSEC-2026-1640
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.