{"action":"Upgrade mlflow to 3.17.2 or later.","affected":[{"fixed":"3.17.2","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2026-53995"],"ecosystem":"PyPI","epss":0.00604,"exploited":false,"fixed_versions":["3.17.2"],"ghsa_id":"GHSA-wqmh-qccw-pqwf","id":"tcs_01M5NCGXEJYYK82VHBMAKYDE0B","modified_at":"2026-10-23T21:45:04.910777174Z","published_at":"2026-10-20T00:31:59Z","references":["https://osv.dev/vulnerability/GHSA-wqmh-qccw-pqwf","https://nvd.nist.gov/vuln/detail/CVE-2026-53995","https://github.com/mlflow/mlflow/issues/26979","https://github.com/mlflow/mlflow/pull/26842","https://github.com/mlflow/mlflow/commit/31ff9e56f5038d61ec75344518912945f60dffec","https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal","https://github.com/mlflow/mlflow/releases/tag/v3.17.2","https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-wqmh-qccw-pqwf","url":"https://osv.dev/vulnerability/GHSA-wqmh-qccw-pqwf"}],"summary":"MLflow FileStore trace IDs allow path traversal and arbitrary file writes"}