We use cookies to improve your experience on our site.
AVID-2026-R1235
Description
Vulnerability CVE-2023-30172
Details
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Reason for inclusion in AVID: CVE-2023-30172 describes a directory traversal vulnerability in MLflow’s /get-artifact API (up to v2.0.1) that can read arbitrary server files. MLflow is an AI/ML platform used in general-purpose AI pipelines, and the issue affects software components used to build/deploy/run AI systems (artifact access). This is a clear security vulnerability with CVE signals and references, relevant to the AI software supply chain.
References
- NVD entry
- https://github.com/mlflow/mlflow/issues/7166
- https://github.com/mlflow/mlflow/issues/7166#issuecomment-1541543234
Affected or Relevant Artifacts
- Developer: n/a
- Deployer: n/a
- Artifact Details:
| Type | Name |
|---|---|
| System | n/a |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2023-05-11
- Version: 0.3.3
- AVID Entry