{"schema":"threatline.record/2","record":{"id":"CVE-2026-53995","aliases":["GHSA-wqmh-qccw-pqwf"],"summary":"MLflow FileStore trace IDs allow path traversal and arbitrary file writes","details":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.","categories":["Libraries & packages"],"product":"mlflow","vendor":"mlflow","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","source_modified_at":"2026-10-23T21:34:10Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"pip","name":"mlflow"},"range":"<= 3.17.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53995","source_modified_at":"2026-10-20T17:34:23.424Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"mlflow","vendor":"mlflow","versions":[{"lessThanOrEqual":"3.17.1","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unknown"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wqmh-qccw-pqwf","source_modified_at":"2026-10-23T21:45:04.910777174Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"name":"mlflow","ecosystem":"PyPI","purl":"pkg:pypi/mlflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.9.0","0.9.0.1","0.9.1","1.0.0","1.1.0","1.1.1.dev0","1.10.0","1.11.0","1.12.0","1.12.1","1.13","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.20.2","1.21.0","1.22.0","1.23.0","1.23.1","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.27.0","1.28.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","source_modified_at":"2026-10-23T21:34:10Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"pip","name":"mlflow"},"version":"3.17.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wqmh-qccw-pqwf","source_modified_at":"2026-10-23T21:45:04.910777174Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"name":"mlflow","ecosystem":"PyPI","purl":"pkg:pypi/mlflow"},"version":"3.17.2"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00561,"percentile":0.4592,"score_date":"2026-10-23"},"published_at":"2026-10-19T21:05:16.530Z","modified_at":"2026-10-23T21:45:04.910777174Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:34:10Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-53995","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T17:34:23.424Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-wqmh-qccw-pqwf","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:45:04.910777174Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53995","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53995","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/mlflow/mlflow/pull/26842","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api","tags":["third-party-advisory"]},{"url":"https://github.com/mlflow/mlflow/issues/26979","source":"GitHub Advisory Database"},{"url":"https://github.com/mlflow/mlflow/commit/31ff9e56f5038d61ec75344518912945f60dffec","source":"GitHub Advisory Database"},{"url":"https://github.com/mlflow/mlflow/releases/tag/v3.17.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-19T21:36:41.493578Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T21:45:04.910777174Z","content_hash":"2e6a9d6c7f3f59bb5df82f6ec0c0d1caef1adabc9cc5970caf174a4ac7d2e35e"}}