CVE-2024-8859

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-8859

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8859.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-8859

Aliases

Published

2025-03-20T10:09:53.459Z

Modified

2026-07-15T01:49:19.226550730Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Path Traversal in mlflow/mlflow

Details

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8859.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-29"
    ]
}

References

Affected packages

Git / github.com/mlflow/mlflow

Affected ranges

Type

GIT

Repo

https://github.com/mlflow/mlflow

Events

Introduced

608f33443a010db711de43772f0f394a0f71bfc5

Fixed

7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654

Database specific

{
    "cpe": "cpe:2.3:a:lfprojects:mlflow:2.15.1:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.15.1"
        },
        {
            "last_affected": "2.15.1"
        }
    ]
}

Affected versions

2.*

2.15.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8859.json"