---
id: CVE-2024-8859
aliases:
  - GHSA-4rqf-8pfm-p36r
  - BIT-mlflow-2024-8859
  - PYSEC-2026-1638
title: MLflow has a Local File Read/Path Traversal in dbfs
summary: MLflow has a Local File Read/Path Traversal in dbfs
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: mlflow
product: mlflow
ecosystem: pip
affected:
  - mlflow < 2.17.0rc0
patched:
  - mlflow 2.17.0rc0
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4rqf-8pfm-p36r'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8859'
  - url: >-
      https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654
  - url: 'https://github.com/mlflow/mlflow'
  - url: 'https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02715
epssPercentile: 0.85389
ingestedAt: '2026-07-08T18:25:45.539Z'
exploits:
  nuclei:
    - CVE-2024-8859
  checkedAt: '2026-09-25T08:20:44.401Z'
exploitAvailable: true
---

## Overview

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.

## Affected packages

- `mlflow < 2.17.0rc0`

## Remediation

Upgrade to a patched release:

- `mlflow 2.17.0rc0`