Willkürliches Schreiben von Dateien über Tar-Traversal in mlflow

The core of this vulnerability lies in MLflow's pyfunc extraction functionality. When MLflow processes a tar.gz archive containing a pyfunc artifact, it uses tarfile.extractall without adequately validating the paths within the archive. A malicious actor can craft a specially designed tar.gz file containing entries with .. (parent directory) sequences or absolute paths. When extracted, these entries will overwrite files outside the intended extraction directory, potentially leading to arbitrary file overwrites. In multi-tenant environments, this could allow an attacker to compromise other users' artifacts or even gain remote code execution if they can overwrite critical system files. The potential blast radius is significant, particularly in deployments where untrusted artifacts are ingested.

Organizations utilizing MLflow in multi-tenant environments or those that ingest machine learning artifacts from untrusted sources are at the highest risk. Specifically, teams relying on automated artifact pipelines without robust validation procedures are particularly vulnerable. Users who have not upgraded to MLflow 3.9.0rc0 or later are also at risk.

• python / mlflow: Inspect MLflow's pyfunc extraction code for missing path validation.

import tarfile

tar = tarfile.open('malicious.tar.gz', 'r:gz')
for member in tar.getmembers():
    member.name = os.path.join('safe_extraction_dir', member.name) # Add path validation here
tar.extractall('extraction_dir')
tar.close()

• linux / server: Monitor file system activity for unexpected writes in MLflow's extraction directories using auditd.

ausearch -m always -f /path/to/mlflow/extraction_dir

• generic web: Monitor access logs for requests containing tar.gz archives with suspicious filenames or paths.

1. 2026-03-19Disclosure

   disclosure

1. Reserviert2025-12-22
2. Veröffentlicht2026-03-19
3. Geändert2026-03-24
4. EPSS aktualisiert2026-03-26

The primary mitigation for CVE-2025-15031 is to upgrade to MLflow version 3.9.0rc0 or later, which includes the necessary path validation fixes. If upgrading immediately is not feasible, consider implementing stricter artifact validation procedures before ingestion. This could involve scanning tar.gz files for malicious path entries before processing them. Additionally, restrict the permissions of the MLflow user to minimize the impact of a successful file overwrite. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious tar.gz files. After upgrading, verify the fix by attempting to extract a crafted tar.gz archive containing malicious path entries and confirming that the extraction fails with an appropriate error.