Threats tagged 'bit-mlflow-2025-15036'

A path traversal vulnerability exists in the extract_archive_to_dir function of mlflow before version 3.9.0. This flaw allows an attacker controlling a tar.gz archive to overwrite arbitrary files on the system, potentially leading to privilege escalation or sandbox escape in multi-tenant or shared cluster environments. The vulnerability is critical and has an available patch.