MLflow's pyfunc extraction process improperly handles tar archive entries by using tarfile.extractall without path validation. This allows maliciously crafted tar.gz files containing directory traversal sequences ('..') or absolute paths to write files outside the intended extraction directory. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It affects all versions of mlflow/mlflow. The CVSS v3.0 score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. The vulnerability can lead to arbitrary file overwrites and potential remote code execution, particularly in multi-tenant or untrusted artifact ingestion scenarios. Red Hat has published an advisory for this CVE but no explicit patch or remediation status is provided in the advisory content.

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory by leveraging path traversal in tar archive extraction. This can lead to overwriting critical files and potentially remote code execution. The impact is high confidentiality and integrity loss. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory is available but does not explicitly state a patch or fix. Until an official fix is released, avoid extracting untrusted tar.gz artifacts with MLflow's pyfunc extraction process or implement manual path validation before extraction to prevent directory traversal.