CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2023-6977Public Exploit

MLflow - Path Traversal (CVE-2023-6977)

PublishedDec 20, 2023
First SeenSep 13, 2026
Last Seen
Reported
CVSS10.0
MLflow
MLflowMLflow
ai_mcp

Description

This vulnerability enables malicious users to read sensitive files on the server.

psychologyCrowdSec Analysis

CVE-2023-6977 is a path traversal vulnerability in mlflow which allows attackers to read sensitive files on the server by manipulating file paths. Exploiting this flaw could lead to unauthorized disclosure of confidential information, potentially exposing credentials, configuration files, or other critical data stored on the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 20th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-6977 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /model-versions/get-artifact endpoint in vulnerable MLflow instances by supplying malicious values to the path parameter, enabling local file inclusion and potential disclosure of sensitive files.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-12-20
Rule Released2025-05-20
CrowdSec First Seen2026-09-13

Related Weaknesses

CWE-29: Path Traversal: '\..\filename'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References