The flaw is in MLflow’s pyfunc extraction routine when handling tar.gz files. A malicious archive can contain path traversal sequences or absolute paths. Because tarfile.extractall is called without validating entry paths, files are written outside the intended extraction directory. An attacker could overwrite critical configuration files or inject executable code, which may result in remote code execution on the MLflow server.

The vulnerability affects the MLflow platform supplied by the vendor mlflow, specifically the product mlflow/mlflow. It is present in the current latest release of MLflow; no older versions are specified, so users should confirm the version they run against vendor guidance.

The CVSS score of 9.1 indicates a critical severity. The EPSS score is below 1%, suggesting a low but non‑negligible likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires providing a crafted tar.gz file to the MLflow pyfunc extraction endpoint, which is common in multi‑tenant or untrusted artifact ingestion scenarios. Successful exploitation would allow arbitrary file overwrite and could lead to remote code execution.