CVE-2024-8859

HIGH NUCLEI

MLflow 2.15.1 - Path Traversal and Arbitrary File Read via DBFS Service URL Handling

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-8859 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.

Nuclei Templates (1)

Mlflow < 2.17.0 - Local File Inclusion
CRITICALby gy741
Shodan: http.title:"mlflow"
FOFA: title="mlflow" || app="mlflow"

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0241
EPSS Percentile 81.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-29
Status published
Products (2)
lfprojects/mlflow 2.15.1
pypi/mlflow 0 - 2.17.0rc0PyPI
Published Mar 20, 2025
Tracked Since Feb 18, 2026