Absolute Path Traversal
CVE-2023-1176
Summary
Absolute Path Traversal in mlflow prior to 2.2.0.
- LOW
- LOCAL
- NONE
- UNCHANGED
- NONE
- LOW
- LOW
- NONE
CWE-36 - Absolute Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
References
Advisory Timeline
- Published