CVE-2026-53995
1 advisory.
PyPI/mlflow CVE-2026-53995: high 8.2
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
Action: Upgrade mlflow to 3.17.2 or later.
pip install mlflow==3.17.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.17.2 | - |
Fixed versions
| 3.17.2 |
Sources
- osv: GHSA-wqmh-qccw-pqwf
- https://nvd.nist.gov/vuln/detail/CVE-2026-53995
- https://github.com/mlflow/mlflow/issues/26979
- https://github.com/mlflow/mlflow/pull/26842
- https://github.com/mlflow/mlflow/commit/31ff9e56f5038d61ec75344518912945f60dffec
- https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal
- https://github.com/mlflow/mlflow/releases/tag/v3.17.2
- https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api
CVE-2026-53995 · published · modified · JSON