CVE-2024-0520: High Path Traversal in MLflow

CVE-2024-0520 is a high severity (8.8) flaw in MLflow, described as remote code execution through unsanitized file names when loading a dataset from an HTTP source. The record lists version 8.2.1. A fix commit exists, but check the project's release notes for the first fixed release.

What's affected

• Product: MLflow, module mlflow.data.http_dataset_source.
• Affected: the record names version 8.2.1.
• Fixed: a commit changes the module. I could not confirm which release shipped it, so check the MLflow release notes.
• CWE: the record lists CWE-22, path traversal, although the description also says command injection. Both are noted here.
• Severity: NVD scores it 8.8 (High).

How to check if you're exposed

1. Run pip show mlflow in each Python environment, container image and notebook server to read the version.
2. Search your code for loads of datasets from HTTP URLs, for example uses of the HTTP dataset source.
3. Check which services pass user or third party URLs to dataset loading.

Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.

What to do now

1. Find every MLflow install and its version.
2. Upgrade to the newest release and read the release notes for the fix.
3. Only load datasets from sources you trust until you have upgraded.
4. Run MLflow with a low privilege account, limited filesystem write access and restricted outbound traffic.
5. Run a reachability scan with Safeguard to see whether your code calls the affected loader.

Why it matters

The weakness is CWE-22, path traversal. When the loader downloads a file, it takes the file name from the Content-Disposition header or the URL path and uses it to build the local path. A name that contains directory parts could therefore place the file outside the intended folder.

The fix commit adds a check that rejects file names containing directory components, with tests for several forms. That is a direct fix for the cause. The record carries no known exploited flag. In ML pipelines, the risk grows when data sources come from outside your control.

Try it yourself

The demo below walks through the same workflow on sample data.

Click through it at your own pace, or open it full screen.

Quick check

Sources

I fetched the commit page. I did not fetch the huntr report.

• https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d
• https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc

Last reviewed: 19 October 2026.