{"action":"Upgrade mlflow to 2.8.1 or later.","affected":[{"fixed":"2.8.1","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2023-6015"],"ecosystem":"PyPI","epss":0.04488,"exploited":false,"fixed_versions":["2.8.1"],"ghsa_id":"GHSA-f798-qm4r-23r5","id":"tcs_01M5KFEPF5S7Q9EVPMG4RE709Q","modified_at":"2026-06-29T12:26:14.098234062Z","published_at":"2023-11-16T18:30:31Z","references":["https://osv.dev/vulnerability/GHSA-f798-qm4r-23r5","https://nvd.nist.gov/vuln/detail/CVE-2023-6015","https://github.com/mlflow/mlflow/pull/10330","https://github.com/mlflow/mlflow/commit/cf83dad4df26dd4a850622fe8a51ccab1471a5e7","https://github.com/mlflow/mlflow","https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-f798-qm4r-23r5","url":"https://osv.dev/vulnerability/GHSA-f798-qm4r-23r5"}],"summary":"MLflow allowed arbitrary files to be PUT onto the server"}