CVE-2025-11201MLflow Path Traversal
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Published Oct 29, 2025 · Updated Oct 28, 2026 · Also known as BIT-mlflow-2025-11201, GHSA-5cvj-7rg6-jggj, PYSEC-2026-1640
Key Facts
Patch immediately- CVE-2025-11201 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting MLflow (Lfprojects).
- It is exploited in the wild, listed in Industry KEV feed since Oct 30, 2026. No public exploit code is known.
- EPSS estimates a 26% probability of exploitation in the next 30 days.
- Fixed versions are available, including MLflow 2025-06-10, MLflow 2.22.4, MLflow 3.0.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
26%
Higher than 97.9% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Oct 30, 2026
366 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2025-11201
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-11201
- advisoryGHSA advisory
- advisoryZDI-25-931
Description
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Oct 30, 2026 | n/a | Not reported |
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| MLflowLfprojects | >= 3.0.0rc0, >= 2.21.3 | 2025-06-10 |
Patched Releases
MLflow
2025-06-10, 2.22.4, 3.0.0
Timeline
Publicly disclosed
Oct 29, 2025
Last updated
Oct 28, 2026
Added to Industry KEV feed
Oct 30, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2025-11201
- advisoryGHSA advisory
- advisoryZDI-25-931
- articlevendor-provided URL
FAQ
Common Questions.
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability.
Affected: MLflow (Lfprojects) versions >= 3.0.0rc0, >= 2.21.3. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Oct 30, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including MLflow 2025-06-10, MLflow 2.22.4, MLflow 3.0.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-11201 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo