{"action":"Upgrade mlflow to 2.2.2 or later.","affected":[{"fixed":"2.2.2","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2023-1176"],"ecosystem":"PyPI","epss":0.00583,"exploited":false,"fixed_versions":["2.2.2"],"ghsa_id":"GHSA-wp72-7hj9-5265","id":"tcs_01M5KGK9PTS0E2ZFV85D48W2BA","modified_at":"2026-06-10T17:02:17.449843317Z","published_at":"2023-03-24T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-28","https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085","https://github.com/mlflow/mlflow/commit/63ef72aa4334a6473ce7f889573c92fcae0b3c0d","https://github.com/advisories/GHSA-wp72-7hj9-5265"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-28","url":"https://osv.dev/vulnerability/PYSEC-2023-28"}],"summary":"Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2."}