{"id":"CVE-2023-1177","summary":"Path Traversal: '\\..\\filename' in mlflow/mlflow","details":"Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.\n\n","aliases":["BIT-mlflow-2023-1177","GHSA-xg73-94fp-g449","PYSEC-2023-29"],"modified":"2026-08-12T13:33:47.056746Z","published":"2023-03-24T00:00:00Z","database_specific":{"cwe_ids":["CWE-29"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1177.json","cna_assigner":"@huntrdev"},"references":[{"type":"WEB","url":"https://github.com/mlflow/mlflow/pull/7891/commits/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e"},{"type":"WEB","url":"https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1177.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1177"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mlflow/mlflow","events":[{"introduced":"0"},{"fixed":"ffe005c58dd45e4f200bfb5a77aa5273a57ca39d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.2.1"}],"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"}}],"versions":["v1.7.0","1.0.0","v0.8.1","v0.8.0","v0.7","v0.6.0","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.1","v0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1177.json","vanir_signatures_modified":"2026-08-12T13:33:47Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mlflow/mlflow/commit/ffe005c58dd45e4f200bfb5a77aa5273a57ca39d","target":{"function":"doGet","file":"mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"},"deprecated":false,"digest":{"function_hash":"315695039987599915833795250148533443280","length":188},"id":"CVE-2023-1177-3d0ffab8"},{"deprecated":false,"digest":{"line_hashes":["184537011841202855010175748683233015740","37052205958489476375165583908706963982","163827101219918441006880180624444697414","297079543708614561370828289053379060808"],"threshold":0.9},"id":"CVE-2023-1177-5daf1389","signature_type":"Line","signature_version":"v1","source":"https://github.com/mlflow/mlflow/commit/ffe005c58dd45e4f200bfb5a77aa5273a57ca39d","target":{"file":"mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java"}},{"id":"CVE-2023-1177-87ebdc7e","signature_type":"Function","signature_version":"v1","source":"https://github.com/mlflow/mlflow/commit/ffe005c58dd45e4f200bfb5a77aa5273a57ca39d","target":{"file":"mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java","function":"testScoringServerWithValidPredictorRespondsToVersionCorrectly"},"deprecated":false,"digest":{"function_hash":"110835240179957637795242358676224518213","length":482}},{"target":{"file":"mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"},"deprecated":false,"digest":{"line_hashes":["203989792986681947897820114496437655629","223341954211807404523867919691887162855","271938718366277703190849776855167632540","235966189990620696098933471156313906891"],"threshold":0.9},"id":"CVE-2023-1177-b1982522","signature_type":"Line","signature_version":"v1","source":"https://github.com/mlflow/mlflow/commit/ffe005c58dd45e4f200bfb5a77aa5273a57ca39d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}]}