The flaw lies in the Tracking Server’s artifact handler where a user‑supplied file path is accepted without validation. This missing guard allows a remote attacker to traverse directories and execute arbitrary code under the service account’s privileges. The impact is full compromise of confidentiality, integrity, and availability of the affected system, as the attacker can run any code the service account can execute.

All installations of MLflow’s Tracking Server are affected. No specific product versions are listed in the advisory; therefore any publicly available release of MLflow Tracking Server that has not applied the patch is vulnerable.

The vulnerability scores 8.1 on CVSS and has a 14% EPSS score, indicating it is high severity and has a non‑negligible chance of exploitation. The attacker can reach the vulnerable endpoint without authentication, typically via the artifact upload feature exposed over the network. If the server is reachable from untrusted networks, exploitation is straightforward and can be executed remotely.