This vulnerability (CWE-29) arises from the lack of validation of file paths when extracting tar.gz archives in the mlflow/mlflow repository's extract_archive_to_dir function. Specifically, malicious tar members with path traversal sequences such as '\..\filename' can cause files to be written outside the designated extraction directory. This flaw affects all versions before v3.7.0. Exploitation requires an attacker to supply a crafted tar.gz file, enabling overwriting of arbitrary files and potential sandbox escape in multi-tenant or shared cluster setups.

Successful exploitation allows an unauthenticated attacker who can supply a malicious tar.gz archive to overwrite arbitrary files on the host system. This can lead to privilege escalation, data corruption, or system compromise, especially in environments relying on sandboxing or multi-tenant isolation. The CVSS score of 9.6 reflects the critical nature with high confidentiality, integrity, and availability impacts.

A fix is available in mlflow version 3.7.0 and later, which includes validation to prevent path traversal during archive extraction. Users should upgrade to version 3.7.0 or newer to remediate this vulnerability. Since no patch links are provided here, verify the vendor advisory or official mlflow release notes for the exact remediation details. Until upgraded, avoid processing untrusted tar.gz files with vulnerable versions.