CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-6976
High (8.8) in lfprojects mlflow. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in mlflow 2.9.2.
This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lfprojects:mlflow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wv8q-4f85-2p8p | PyPI | mlflow | <2.9.2 | 2.9.2 |
| PYSEC-2026-1662 | PyPI | mlflow | <2.9.2 | 2.9.2 |