This vulnerability (CWE-29, CWE-22) in mlflow/mlflow arises from the lack of validation of file paths within tar archives processed by the extract_archive_to_dir function in the mlflow/pyfunc/dbconnect_artifact_cache.py file. Versions prior to 3.7.0 are affected. Exploitation allows an attacker who can supply a malicious tar.gz archive to perform path traversal attacks, potentially overwriting arbitrary files outside the intended extraction directory. This can lead to privilege escalation or sandbox escape in environments where mlflow is used in multi-tenant or shared cluster setups. The CVSS v3.0 score is 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in arbitrary file overwrite outside the intended extraction directory, enabling attackers to modify or replace critical files. This can lead to privilege escalation, sandbox escape, and compromise of multi-tenant or shared cluster environments where mlflow is deployed. The vulnerability impacts confidentiality, integrity, and availability of affected systems.

A fix is available in mlflow version 3.7.0 and later. Users should upgrade to version 3.7.0 or newer to remediate this vulnerability. The vendor advisory from Red Hat confirms the issue and provides guidance on patching. Until upgrading, avoid processing untrusted tar.gz files with the vulnerable function to mitigate risk.