The vulnerability is a path‑traversal flaw (CWE‑22) in the FileStore tracking backend of MLflow that permits an unauthenticated attacker to supply a crafted trace ID when calling the POST /api/3.0/mlflow/traces endpoint. The attacker’s payload can contain traversal sequences that cause FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files outside the intended experiment trace directory. Because these files are written with the permissions of the MLflow process, the flaw can lead to arbitrary file write and potentially remote code execution if the attacker writes executable payloads to a location that MLflow or other services subsequently read.

The flaw affects mlflow:mlflow versions 3.7.0 through 3.17.1 inclusive when the FileStore backend is active. MLflow switched its default tracking backend to SQLite after version 3.7.0, so deployments that have not explicitly enabled FileStore are only vulnerable if they have opted into the older default behavior. Any system running the affected range with the FileStore backend exposed to unauthenticated traffic poses a risk.

The CVSS score of 8.8 indicates high severity, and although EPSS is not publicly available, the lack of KEV listing does not diminish the exploitability; the vulnerability is exploitable without authentication and relies on a single POST request that can be crafted from any network location that can reach the API. The combination of unrestricted write access and lack of authentication makes the attack vector nearly trivial for a determined adversary.