{"id":"CVE-2024-1483","aliases":["GHSA-f82r-jj5r-6g97","BIT-mlflow-2024-1483","PYSEC-2026-1650"],"title":"mlflow Path Traversal vulnerability","summary":"mlflow Path Traversal vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"mlflow","product":"mlflow","ecosystem":"pip","affected":["mlflow < 2.12.1"],"patched":["mlflow 2.12.1"],"published":"2024-04-16","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f82r-jj5r-6g97","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1483"},{"url":"https://github.com/mlflow/mlflow"},{"url":"https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d"}],"tags":["osv","pip","exploit-available"],"epss":0.02718,"epssPercentile":0.85381,"ingestedAt":"2026-07-08T18:25:48.819Z","exploits":{"nuclei":["CVE-2024-1483"],"checkedAt":"2026-09-23T07:13:28.245Z"},"exploitAvailable":true,"slug":"CVE-2024-1483","body":"## Overview\n\nA path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.\n\n## Affected packages\n\n- `mlflow < 2.12.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mlflow 2.12.1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4686,"id":"CVE-2024-1483","ts":1788887199740,"field":"exploit_available","old":"false","new":"true"},{"seq":3569,"id":"CVE-2024-1483","ts":1788886316237,"field":"exploit_available","old":"true","new":"false"},{"seq":2423,"id":"CVE-2024-1483","ts":1788882985001,"field":"exploit_available","old":"false","new":"true"},{"seq":1452,"id":"CVE-2024-1483","ts":1788882398270,"field":"exploit_available","old":"true","new":"false"},{"seq":566,"id":"CVE-2024-1483","ts":1788881834593,"field":"exploit_available","old":"false","new":"true"}]}