Executive brief
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Affected products
- PyPI mlflow
Junglewise Threat Intelligence
CVE-2025-11201: PYSEC-2026-1640 - MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
CVE-2025-11201 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: mlflow (PyPI). Vendors: PyPI.
Related threats
- MLflow statsmodels flavor security control bypass in pickle deserialization
- MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauth
- MLflow AI Gateway SSRF via unvalidated api_base
- PYSEC-2026-1639 - mlflow Creates of Temporary File in Directory with Insecure Permissions
- PYSEC-2026-1656 - MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation