https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T06:44:10.607724+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mlflow-2024-1483 BIT-mlflow-2024-1483 — Path Traversal Vulnerability in mlflow/mlflow 2026-10-25T06:44:10.611981+00:00

Affected: Bitnami: mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

 https://cve.radiocsirt.org/vuln/cnvd-2024-35608 cnvd-2024-35608 2026-10-25T06:44:10.612027+00:00 cnvd-2024-35608 https://cve.radiocsirt.org/vuln/euvd-2026-1705 EUVD-2026-1705 2026-10-25T06:44:10.612044+00:00 EUVD-2026-1705 https://cve.radiocsirt.org/vuln/fkie_cve-2024-1483 fkie_cve-2024-1483 2026-10-25T06:44:10.612056+00:00

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

 https://cve.radiocsirt.org/vuln/ghsa-f82r-jj5r-6g97 GHSA-f82r-jj5r-6g97 — mlflow Path Traversal vulnerability 2026-10-25T06:44:10.612079+00:00

Affected: PyPI: mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

 https://cve.radiocsirt.org/vuln/gsd-2024-1483 gsd-2024-1483 2026-10-25T06:44:10.612100+00:00 gsd-2024-1483 https://cve.radiocsirt.org/vuln/pysec-2026-1650 PYSEC-2026-1650 — mlflow Path Traversal vulnerability 2026-10-25T06:44:10.612111+00:00

Affected: PyPI: mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.