MLFlow Pfadübergreifungs-Schwachstelle

The core of the vulnerability lies in the extractarchiveto_dir function, which lacks proper validation of tar member paths. An attacker can craft a malicious tar.gz archive containing paths designed to overwrite critical system files or configuration data outside the intended extraction directory. This could lead to complete system compromise, data exfiltration, or denial of service. In multi-tenant environments, the attacker could potentially pivot to other user accounts or containers, significantly expanding the blast radius. The ability to overwrite arbitrary files makes this a high-impact vulnerability, as it bypasses typical sandbox protections.

Organizations using MLflow in multi-tenant or shared cluster environments are particularly at risk. This includes data science teams deploying machine learning models in cloud-based platforms or containerized environments. Legacy MLflow deployments using older versions are also vulnerable.

• python / mlflow:

import os
import tarfile

def check_mlflow_vulnerability(archive_path):
    try:
        with tarfile.open(archive_path, 'r') as tar:
            for member in tar.getmembers():
                if '..' in member.name:
                    print(f"Potential path traversal detected in member: {member.name}")
                    return True
        return False
    except Exception as e:
        print(f"Error processing archive: {e}")
        return False

# Example usage
archive_path = 'path/to/your/archive.tar.gz'
if check_mlflow_vulnerability(archive_path):
    print("Vulnerability potentially present.")
else:
    print("No immediate path traversal vulnerability detected.")

• generic web: Check for unusual file creations or modifications in the MLflow artifact store directory. Monitor system logs for errors related to file access or extraction.

1. 2026-03-30Disclosure

   disclosure

1. Reserviert2025-12-23
2. Veröffentlicht2026-03-30
3. Geändert2026-04-01
4. EPSS aktualisiert2026-04-06

The primary mitigation for CVE-2025-15036 is to upgrade to MLflow version 3.9.0rc0 or later, which includes the necessary path validation fixes. If upgrading immediately is not feasible, consider implementing stricter file system permissions to limit the impact of potential overwrites. Implement a Web Application Firewall (WAF) with rules to block suspicious file paths or archive uploads. Carefully scrutinize any tar.gz files before extraction, especially if their source is untrusted. After upgrading, confirm the fix by attempting to extract a known malicious archive and verifying that the extraction is denied due to path validation.