MLflow目录遍历漏洞(CVE-2023-2356)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2356
• https://github.com/advisories/GHSA-x422-6qhv-p29g
• https://security.snyk.io/vuln/SNYK-PYTHON-MLFLOW-5488283
• https://huntr.dev/bounties/7b5d130d-38eb-4133-8c7d-0dfc9a9d9896
• https://github.com/mlflow/mlflow/commit/f73147496e05c09a8b83d95fb4f1bf86696c6342
• https://www.sentinelone.com/vulnerability-database/cve-2023-2356/
• https://sahnounoussama.medium.com/mlflow-path-traversal-cve-2023-2356-395838f264b5
• https://cn-sec.com/archives/1708551.html
• https://getsafety.com/vulnerabilities/60592
• https://www.ddpoc.com/DVB-2025-9205.html

Related Vulnerabilities

• MLflow /api/2.0/mlflow/webhooks 服务器端请求伪造漏洞（CVE-2026-64849）
• PoCCVE-2026-64849: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
• PoCCVE-2026-2614: MLflow <= 3.9.0 - Arbitrary File Read
• MLflow 存在任意文件读取漏洞（CVE-2026-2614）
• PoCCVE-2026-2652: MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes
• MLflow /ajax-api/3.0/jobs/search 权限绕过漏洞 （CVE-2026-2652）
• PoCCVE-2026-0545: MLflow Job API - Authentication Bypass
• PoCCVE-2023-1177: Mlflow <2.2.1 - Local File Inclusion
• PoCCVE-2023-2356: Mlflow <2.3.0 - Local File Inclusion
• PoCCVE-2023-2780: Mlflow <2.3.1 - Local File Inclusion Bypass
• PoCCVE-2023-3765: MLflow Absolute Path Traversal
• PoCCVE-2023-43472: MLFlow < 2.8.1 - Sensitive Information Disclosure
• PoCCVE-2023-6018: Mlflow - Arbitrary File Write