A path traversal flaw in mlflow’s “extract_archive_to_dir” function lacks validation of tar archive member paths. An attacker who can supply a crafted tar.gz file can cause the function to write files outside the intended directory, allowing overwriting of arbitrary files or escape from a sandbox. This can lead to privilege escalation or arbitrary code execution, compromising confidentiality, integrity, and availability.

The vulnerability affects the mlflow open‑source machine learning platform. All releases before version 3.7.0 are impacted; upgrades to 3.7.0 or later mitigate the issue.

The CVSS score of 9.6 indicates critical severity, yet the EPSS score is below 1 %, showing a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would involve remotely uploading a malicious tar.gz file to a mlflow instance that performs automatic extraction. If such uploads are possible, an attacker could overwrite critical files or elevate privileges. The risk remains high given the potential impact, even though the probability of exploitation appears low at present.