CVE-2025-15031: Arbitrary file write via tar traversal in mlflow
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extraction directory.
Published Mar 19, 2026
Affected packages
mlflow
- Ecosystem
- PyPI
- Affected
- < 3.9.0rc0
- Fixed in
- 3.9.0rc0
- Check
pip show mlflow
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-15031
- https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e
- https://github.com/mlflow/mlflow/commit/3bf6d81ac4d38654c8ff012dbd0c3e9f17e7e346
- https://github.com/mlflow/mlflow/blob/fe4d9be330426904283401f1d2ed914238b6fc37/mlflow/pyfunc/dbconnect_artifact_cache.py#L140
- https://github.com/advisories/GHSA-fhff-qmm8-h2fp
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More MLflow vulnerabilities
All MLflow entriesCVE-2026-115886
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
medium6.5Oct 23, 2026CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
high8.2Oct 20, 2026GHSA-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
high8.8Sep 1, 2026CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
critical9.3ExploitedAug 17, 2026CVE-2026-71211
MLflow AI Gateway permits SSRF through an unvalidated api_base
high7.1No fixAug 5, 2026CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
high8.1Jul 2, 2026