A critical path traversal vulnerability in MLflow allows unauthenticated attackers to perform arbitrary file writes, posing a severe risk of remote code execution.

The flaw exists in the pyfunc extraction process due to improper handling of tar archive entries. By using tarfile.extractall without path validation, an unauthenticated attacker can supply crafted tar.gz files containing directory traversal sequences to overwrite files outside the intended directory.

Successful exploitation of this vulnerability allows an attacker to overwrite critical system files, which can be leveraged to achieve remote code execution. Given the CVSS score of 8.1, this represents a high-severity risk, particularly in multi-tenant environments or systems that ingest untrusted artifacts. Unauthorized access to the underlying host could lead to total compromise of the application environment and sensitive data theft.

Immediate Action: Update the MLflow package to version 3.9.0rc0 or later to implement proper path validation for tar archive extraction.

Proactive Monitoring: Monitor application logs for unusual file system write operations or unexpected attempts to access directories outside of designated artifact storage locations.

Compensating Controls: Implement strict input validation for all uploaded artifacts and ensure the application runs with the minimum necessary privileges to limit the impact of a potential file system overwrite.

Public Exploit Available: No (There is no confirmed public exploit or weaponized module; per CISA's SSVC assessment, a proof-of-concept exists).

The severity of this vulnerability, combined with the potential for remote code execution, necessitates immediate attention. Organizations utilizing MLflow to process external artifacts must prioritize upgrading to the patched version. Until updates are applied, restrict artifact ingestion to trusted sources only to mitigate the risk of exploitation.