https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T06:59:53.235563+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-15031 CVE-2025-15031 — Path Traversal Vulnerability in mlflow/mlflow 2026-10-22T06:59:53.247789+00:00

Affected: mlflow/mlflow, Red Hat OpenShift AI (RHOAI)

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.

 https://cve.radiocsirt.org/vuln/pysec-2026-2656 PYSEC-2026-2656 — Arbitrary file write via tar traversal in mlflow 2026-10-22T06:59:53.247861+00:00

Affected: PyPI: mlflow

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.