The flaw lies in the Tracking Server’s artifact handler where a user‑supplied file path is accepted without validation. This missing guard allows a remote attacker to traverse directories and execute arbitrary code under the service account’s privileges. The impact is full compromise of confidentiality, integrity, and availability of the affected system, as the attacker can run any code the service account can execute.

All installations of MLflow Tracking Server are affected. No specific product versions are listed in the advisory; therefore any publicly available release of MLflow Tracking Server that has not applied the patch is vulnerable.

The description states that authentication is not required, but the exact attack vector is not detailed. Based on the description, it is inferred that the attacker can reach the vulnerable endpoint via the artifact upload feature over the network. If the server is reachable from untrusted networks, exploitation could be possible remotely. The vulnerability scores 8.1 on CVSS and has a 14% EPSS score, indicating high severity and a non‑negligible chance of exploitation. The vulnerability is not listed in the CISA KEV catalog.