A path traversal flaw resides in the extract_archive_to_dir function within mlflow's artifact cache module. Because tar member paths are not validated, a maliciously crafted tar.gz file can cause the service to write files outside its intended directory. This enables an attacker to overwrite critical configuration files or inject code, effectively creating a privilege escalation or remote code execution vector on shared clusters.

mlflow, the open‑source machine‑learning platform, is affected in all releases prior to v3.7.0. Users running older mlflow versions on multi‑tenant or shared clusters are at risk.

The CVSS score of 9.6 indicates a very high severity vulnerability, and the KEV database does not list it, which does not reduce the threat. No EPSS score is available, but the exploit path is straightforward: an attacker who can provide a malicious tar.gz file to mlflow must craft a parent‑directory reference that allows the service to escape the sandbox. Based on the description, it is inferred that the attack vector requires the attacker to supply such a file, so environments that accept untrusted archives face a high likelihood of exploitation.