CVE-2025-15036

What it actually does

CVE-2025-15036 is a path traversal flaw in MLflow before version 3.7.0, specifically in the extract_archive_to_dir function in mlflow/pyfunc/dbconnect_artifact_cache.py. The vulnerable code extracts attacker-controlled tar.gz archives without safely validating each tar member path. A malicious archive can contain entries such as ../ paths, absolute paths, or crafted links that cause extracted files to be written outside the intended artifact cache directory. Depending on the privileges of the MLflow process and where files are overwritten, this can lead to arbitrary file overwrite, configuration tampering, credential exposure, denial of service, or code execution through replacement of scripts, Python modules, startup files, scheduled jobs, or other trusted files. The CVSS score of 10.0 reflects network exploitability, low attack complexity, no required privileges, no user interaction, and potential confidentiality, integrity, and availability impact across a changed scope.

Why it matters to the business

An attacker who can supply or influence a tar.gz artifact processed by vulnerable MLflow versions may be able to tamper with files outside the intended workspace. In shared ML, data science, or cluster environments, this can undermine tenant isolation, corrupt model or experiment artifacts, disrupt pipelines, expose credentials, or create a foothold for broader system compromise. Although EPSS is currently low and no known CISA KEV listing or mature public exploitation is indicated, the severity is critical because successful exploitation can convert artifact handling into arbitrary file overwrite and possible privilege escalation. Organizations using MLflow in production, shared notebooks, model registries, or automated training/deployment workflows should treat affected deployments as high priority for upgrade.

How an attack unfolds

An attacker first gains a way to place or reference a tar.gz file that MLflow will process through the vulnerable DBConnect artifact cache extraction path. The attacker crafts the archive with tar member names designed to escape the target extraction directory, such as entries containing ../ sequences, absolute paths, or link-based traversal behavior. When MLflow extracts the archive, the vulnerable function fails to canonicalize and enforce that every extracted path remains within the intended sandbox directory. As a result, files are written to attacker-selected locations on the filesystem. The attacker may overwrite benign files to cause service disruption, overwrite application configuration to alter behavior, plant Python code in importable paths, replace scripts executed by automation, add credentials or authorized keys where permissions allow, or modify startup/scheduled execution mechanisms. In multi-tenant or shared cluster deployments, this may allow the attacker to cross isolation boundaries by modifying files used by the MLflow service account, adjacent jobs, or shared runtime components.

How to fix it

Upgrade MLflow to version 3.7.0 or later. Treat all versions before 3.7.0 as affected where the vulnerable artifact cache extraction code is present. If immediate upgrade is not possible, reduce exposure by blocking untrusted tar.gz artifacts, disabling workflows that process externally controlled archives, running MLflow with a dedicated least-privilege service account, enforcing filesystem sandboxing, using container/AppArmor/SELinux restrictions, and ensuring artifact extraction occurs only in isolated temporary directories. Implement or backport safe archive extraction controls: reject absolute paths, reject paths containing traversal components after canonicalization, reject unsafe symlinks and hardlinks, and verify that the resolved destination path for every archive member remains within the intended extraction root before writing. Rotate credentials if there is evidence that sensitive files may have been overwritten or exposed.

How to confirm the fix worked

Confirm the installed MLflow version is 3.7.0 or later using package metadata, dependency lockfiles, container manifests, or runtime version checks. Review build artifacts and images to ensure no older MLflow package remains in active use. Where feasible, run a controlled negative test in a non-production environment using a tar.gz archive containing a harmless traversal entry and verify that extraction is rejected and no file is created outside the intended directory. Inspect patched source or vendor package behavior to confirm archive member paths are normalized, links are handled safely, and destination paths are constrained to the extraction directory. Validate that the MLflow service account cannot write to sensitive OS, application, or shared cluster paths. Confirm artifact upload/fetch paths are restricted to trusted sources until all deployments are upgraded.

Typical attack path

1. Identify an MLflow deployment or workflow running a vulnerable version before 3.7.0 that processes externally supplied or attacker-influenced tar.gz artifacts.
2. Create a malicious tar.gz archive containing tar entries with traversal paths, absolute paths, or crafted link behavior intended to escape the artifact cache directory.
3. Submit, upload, register, or cause the malicious archive to be fetched by the MLflow workflow that invokes the vulnerable extraction function.
4. Wait for MLflow to extract the archive through mlflow/pyfunc/dbconnect_artifact_cache.py without validating member paths.
5. Overwrite files outside the intended extraction directory, such as configuration files, Python modules, job scripts, credentials, or service-controlled files, subject to filesystem permissions.
6. Trigger or wait for the overwritten file to be read or executed, resulting in service disruption, privilege escalation, credential exposure, or code execution.

How to detect it

To determine whether exploitation already occurred, review MLflow application logs, artifact upload/fetch records, object storage access logs, reverse proxy logs, container logs, and host filesystem telemetry around times when tar.gz artifacts were processed. Look for archives whose member names contain path traversal sequences, absolute paths, or symlink/hardlink entries that resolve outside the expected artifact cache directory. If archives are retained, inspect them with tar listing tools without extracting them and flag entries containing ../, leading /, Windows drive prefixes, or links targeting paths outside the extraction root. On hosts and containers running MLflow, search file integrity monitoring, EDR, auditd, sysmon-for-Linux, Kubernetes audit logs, and shell/process telemetry for unexpected file writes by the MLflow process account outside normal artifact/cache paths. Pay particular attention to modifications of Python site-packages, MLflow code paths, job scripts, shell startup files, SSH authorized_keys files, cron/systemd locations, application configuration, and credential files. Correlate suspicious file writes with subsequent execution of modified scripts, new child processes from MLflow workloads, authentication anomalies, or outbound network connections. Because no specific public exploitation indicators or named threat actor activity are provided, detection should focus on behavioral evidence of unsafe tar extraction and arbitrary file overwrite rather than fixed attacker infrastructure.

• mlflow/pyfunc/dbconnect_artifact_cache.py
• extract_archive_to_dir
• ../
• ..\\
• /etc/cron.d/
• /etc/systemd/system/
• /etc/ld.so.preload
• /root/.ssh/authorized_keys
• .ssh/authorized_keys
• site-packages/
• /tmp/
• /var/spool/cron/
• cron.d
• authorized_keys

What your security team should do

• Inventory all MLflow deployments, containers, notebooks, training pipelines, model registry services, and shared ML platforms for MLflow versions before 3.7.0.
• Upgrade affected MLflow installations to version 3.7.0 or later as a priority due to the critical arbitrary file overwrite impact.
• Temporarily block or quarantine untrusted tar.gz artifacts and disable automated extraction of externally supplied archives until patched.
• Review recent artifact ingestion activity for malicious tar member paths, especially archives containing ../, absolute paths, suspicious symlinks, or hardlinks.
• Harden MLflow runtime permissions so the service account cannot write to sensitive system paths, user SSH directories, startup locations, package directories, or shared cluster control paths.
• Add detection logic for unsafe archive members and unexpected writes outside MLflow artifact/cache directories.
• If suspicious extraction is found, preserve the archive, filesystem metadata, MLflow logs, container layers, and process execution evidence before remediation.
• Rotate secrets and tokens accessible to the MLflow process if arbitrary file read/write exposure or filesystem tampering is suspected.