Path Traversal in MLflow via Malicious model_id Parameter

Executive Summary

This is a path traversal vulnerability in MLflow versions before 3.18.0 when using the FileStore backend. Attackers can exploit it by sending a malicious model_id containing ../ sequences to the POST /api/3.0/mlflow/runs/outputs endpoint. This allows writing files outside the intended run directory, including creating directories and writing meta.yaml files at arbitrary filesystem locations. The vulnerability exists because model_id values were not properly validated before being used in file paths.

Useful 0 Not Useful 0

Detection Guidance

Check if your MLflow instance is running a version before 3.18.0 by running: mlflow --version. Inspect network traffic for POST requests to /api/3.0/mlflow/runs/outputs with model_id containing ../ or absolute paths. Review filesystem logs for unexpected directory creation or meta.yaml files outside run directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious files anywhere on the server filesystem where the MLflow process has write permissions. This could lead to arbitrary code execution, data exfiltration, or system compromise. The impact is limited only by the permissions of the MLflow server account. The vulnerability allows unauthenticated remote attackers to manipulate file system paths through the log outputs API.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade MLflow to version 3.18.0 or later immediately. Disable the FileStore backend if not required by setting MLFLOW_ALLOW_FILE_STORE=false. Monitor filesystem access and restrict server account permissions to limit potential damage from exploitation attempts.

Useful 0 Not Useful 0