-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated 'path' parameters in API handlers. The patch adds validate_path_is_safe() checks to these three functions, which directly process user-controlled 'path' input. Before the fix, these functions passed the raw path parameter to artifact handling logic without normalization or traversal checks, as evidenced by the commit diff adding validation to all three endpoints. The CWE-22 pattern matches unvalidated path concatenation in file operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | < 2.0.0rc0 | 2.0.0rc0 |
Ongoing coverage of React2Shell