Is CVE-2025-15036 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15036 being exploited in the wild.

How severe is CVE-2025-15036?

Critical severity, with a CVSS score of 10, published 30 March 2026.

Which products and versions are affected?

mlflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.9.0rc0.

Is there a fix for CVE-2025-15036?

Yes. mlflow (PyPI): upgrade to 3.9.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-15036 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15036?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15036: MLflow path traversal in extract_archive_to_dir

CVE-2025-15036 · Severity: critical · CVSS 10 · Published 2026-03-30

MLflow is an open-source platform used by organizations to manage the machine learning lifecycle, including tracking experiments and deploying models. A security flaw in how it handles compressed archive files allows an attacker to write files to unauthorized locations on the server. This could lead to a total system takeover, data theft, or the ability to bypass security boundaries in shared cloud environments.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-15036 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15036 being exploited in the wild.
How severe is CVE-2025-15036?: Critical severity, with a CVSS score of 10, published 30 March 2026.
Which products and versions are affected?: mlflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.9.0rc0.
Is there a fix for CVE-2025-15036?: Yes. mlflow (PyPI): upgrade to 3.9.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-15036 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15036?: Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (PyPI): upgrade to 3.9.0rc0 or later
```
pip install "mlflow>=3.9.0rc0"
```

Technical details

A path traversal vulnerability (CWE-22/CWE-29) exists in the `extract_archive_to_dir` function within `mlflow/pyfunc/dbconnect_artifact_cache.py`. The root cause is a failure to validate tar member paths during the extraction of `tar.gz` files. An attacker who can provide or influence a malicious archive can use '..' sequences to escape the intended destination directory. This can be leveraged to overwrite sensitive system files, achieve arbitrary code execution, or escape sandboxes in multi-tenant or shared cluster environments. The issue is fixed in MLflow version 3.7.0 and later.

Affected products

MLflow MLflow < 3.7.0
Red Hat OpenShift AI (RHOAI) Affected

Identifiers

CVE-2025-15036
GHSA-vhcx-3pq2-4fvc
PYSEC-2026-425

Timeline

2025-01-01: other: Initial Red Hat VEX release date
2026-03-30: disclosed: Public disclosure and NVD publication
2026-03-30: advisory: Red Hat security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.