Relative Path Traversal
CVE-2023-2356
Summary
Relative Path Traversal in mlflow package versions prior to 2.3.1.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- HIGH
- NONE
CWE-23 - Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
References
Advisory Timeline
- Published