dbcve.org
MlflowApplication · Lfprojects

CVE-2025-11201

CRITICAL · 9.8 CVSS v3.1 Published 2025-10-29
Fix available
A fix is available. Upgrade to 2025-06-10 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is a directory traversal vulnerability in MLflow Tracking Server's model file path handling. The lack of proper validation on user-supplied paths before file operations allows attackers to traverse directories and write/overwrite arbitrary files. Combined with the ability to place malicious code in executable locations, this enables unauthenticated remote code execution in the context of the service account.

MitigationImplement strict path validation and sanitization for all model file paths - validate that paths resolve to expected directories, use allowlist approaches, and prevent path traversal sequences (.., absolute paths). Apply available security patches from MLflow immediately.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
MlflowApplication
Affected:< 2025-06-10

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify MLflow installation and version
    Run 'pip show mlflow' or check your package manager to determine the installed MLflow version and compare it to the affected date-based version of 2025-06-10
    Affected if The installed version is earlier than the 2025-06-10 release
  2. Confirm MLflow Tracking Server is running
    Check if the MLflow Tracking Server process is active and accessible on its configured host and port (default 5000)
    Affected if The Tracking Server is exposed and accessible to network attackers
  3. Determine if authentication is enabled on the Tracking Server
    Inspect the MLflow server configuration or environment variables for authentication settings (e.g., MLFLOW_TRACKING_AUTH, MLFLOW_TRACKING_USERNAME) or check if reverse proxy authentication is configured
    Affected if The server allows unauthenticated requests, as the vulnerability enables unauthenticated remote code execution
  4. Check model artifact storage configuration
    Review the MLflow Tracking Server configuration for artifact store backend (e.g., S3, GCS, Azure Blob, or local filesystem) and any custom artifact root settings
    Affected if The server uses a storage backend that allows file write operations to arbitrary paths, particularly local filesystem storage without strict path validation
  5. Verify network exposure of the Tracking Server
    Determine whether the MLflow Tracking Server is listening on a public or internal network interface by reviewing bind address settings and firewall rules
    Affected if The server is accessible from untrusted network segments where attackers can supply malicious file paths

Your environment is affected if the MLflow version predates the 2025-06-10 release AND the Tracking Server is accessible without proper authentication, allowing untrusted users to supply file paths that could traverse beyond intended directories.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2025-06-10 or later
Fixed in 2025-06-10
Vendor patch github.com →
Interim mitigation

Implement strict path validation and sanitization for all model file paths - validate that paths resolve to expected directories, use allowlist approaches, and prevent path traversal sequences (.., absolute paths). Apply available security patches from MLflow immediately.

Recommended fix Moderate confidence

Check official MLflow releases for version containing the fix (the community patch was submitted on 2025-06-10)

  1. 1. Identify your current MLflow version by running `mlflow --version` or checking your installed package.
  2. 2. Obtain the patched commit from the community contributor: https://github.com/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161
  3. 3. Review the patch changes to understand the code modifications made for path validation.
  4. 4. Verify if an official MLflow release containing this fix has been published by checking the official MLflow GitHub repository releases.
  5. 5. If an official release is available, upgrade to that version following standard package upgrade procedures (e.g., `pip install --upgrade mlflow`).
  6. 6. If applying the patch manually, ensure proper code review and testing in a non-production environment first.
  7. 7. After applying the fix, restart the MLflow Tracking Server.
  8. 8. Test that model creation functionality works correctly and that path traversal attempts are blocked.
Caveat If applying the patch manually, ensure compatibility with your current MLflow version and dependencies

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Mlflow Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing10.0 h
  • Review / QA6.0 h
34.0 hours of engineering $5,940
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $9,504.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-11201 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-11201 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data