CVE-2025-15036

✦ AI Explanation

A path traversal vulnerability in the mlflow/mlflow repository allows attackers to overwrite arbitrary files or gain elevated privileges by exploiting the lack of validation of tar member paths during extraction. This issue affects versions before v3.7.0 and can be triggered by an attacker with control over the tar.gz file. The vulnerability can lead to escaping the sandbox directory in multi-tenant or shared cluster environments.

How to Fix

1. 1Update the mlflow/mlflow repository to version v3.7.0 or later. 2. Validate tar member paths during extraction to prevent path traversal attacks. 3. Implement additional security measures, such as access controls and input validation, to prevent exploitation.