CVE-2023-30172: Lfprojects MLflow

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.

Affected products

• Lfprojects MLflow: before 2.0.1 (fixed in 2.0.1)

Published 2023-05-11. Last modified 2026-06-17.