Introduction
Remote code execution on machine learning infrastructure can mean stolen intellectual property, tampered models, or a fully compromised production system. In CVE-2025-11201, improper input validation in MLflow, a widely used ML platform, can expose organizations to those risks, and the attacker needs no credentials to do it.
MLflow is an open-source platform for managing the machine learning lifecycle, hosted under the Linux Foundation. It has a large user base in research and industry and integrates with the major ML frameworks. Its Tracking Server component is often deployed as the central point for experiment tracking and model management.
Technical Information
CVE-2025-11201 is a directory traversal vulnerability in the MLflow Tracking Server's model creation process. The server does not properly validate user-supplied file paths before it uses them in file operations. The source parameter passed to the model creation endpoints is not sanitized, so an attacker can include traversal sequences such as ../.
An attacker sends a crafted HTTP POST request to the model version creation endpoint with a source value that contains traversal sequences. This escapes the intended artifact directory and lets the attacker write files to arbitrary locations on the server filesystem. If one of those files is later loaded by the Python interpreter (for example, a .py or .pth file in a directory within sys.path), arbitrary code runs in the context of the MLflow service account.
The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It does not require authentication, which makes it considerably more serious in exposed environments.
For more details, see the Zero Day Initiative advisory and the public patch commit.
Affected Systems and Versions
- MLflow Tracking Server is affected.
- Versions before the public patch in this commit contain the vulnerability.
- Every configuration where the Tracking Server is network-accessible and the model creation endpoints are exposed is vulnerable.
Vendor Security History
MLflow has had earlier path traversal and file handling vulnerabilities, including:
- CVE-2023-1177: Path traversal in static file serving
- CVE-2023-6018: Arbitrary file write via artifact handling
- CVE-2024-1483: Path traversal via URI fragment
The vendor typically patches promptly and takes part in coordinated disclosure programs such as the Zero Day Initiative.
