CVE-2023-6909

Nuclei

Path Traversal: '\..\filename' in mlflow/mlflow

Title source: CVE List
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2023-6909.

Description

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 30, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

3
ProductSourceVersion range

mlflow

Browse lfprojects / mlflow
VulnCheckVersion data not supplied

mlflow/mlflow

Browse mlflow / mlflow/mlflow
CVE ListBefore 2.9.2affected

mlflow

Browse PyPI / mlflow
GitHub AdvisoryBefore 2.9.2 · Fixed in 2.9.2affected

Nuclei templates

1
ProjectDiscoveryHIGHMlflow <2.9.2 - Path TraversalCVSS 7.5

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

Impact

Successful exploitation could be lead to disclose of sensitive information such as SSH Keys or Internal configurations.

Remediation

To fix this vulnerability, it is important to update the mlflow package to the latest version 2.10.0.

WeaknessesCWE-29
AuthorsHyunsoo-ds
Template tagscvecve2023mlflowlfiintrusivelfprojectsvulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
Shodan: http.title:"mlflow"
FOFA: title="mlflow"
FOFA: app="mlflow"
Google: intitle:"mlflow"
https://huntr.com/bounties/11209efb-0f84-482f-add0-587ea6b7e850/ https://nvd.nist.gov/vuln/detail/CVE-2023-6909 https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1

Source: ProjectDiscovery

References

5