-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly references _create_model_version() as the entry point where improper 'source' parameter validation occurs. The function _validate_non_local_source_contains_relative_paths() is directly implicated as the flawed validation mechanism that fails to detect crafted payloads. Both functions are in server/handlers.py, and their interaction creates the vulnerable path traversal chain: flawed validation in _validate_non_local_source_contains_relative_paths() enables malicious 'source' values to propagate to _create_model_version(), which then uses the tainted input to expose files via /model-versions/get-artifact.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | <= 2.9.2 | 2.12.1 |