CVE-2024-1560 is a high severity (CVSS 8.1) path traversal in MLflow's artifact deletion feature. A double decoding of the path allows deletion of arbitrary directories on the server's file system. The record says the issue is present up to version 2.9.2, despite an earlier fix for CVE-2023-6831. Upgrade past 2.9.2.
What's affected
The record says the issue is present up to and including version 2.9.2. It affects the artifact deletion handler and the local_file_uri_to_path function, through an extra unquote step in the delete_artifacts function of local_artifact_repo.py.
The record notes that an earlier attempt to fix a similar problem, CVE-2023-6831, did not close this variant. It names no fixed release. The huntr report is the only reference and I did not retrieve it, so check the MLflow release notes for the fix.
How to check if you're exposed
Read the installed MLflow version:
pip show mlflow
Then work out which of your servers use the local artifact store and whether they take network requests. The deletion path matters most where artifacts sit on a local disk that also holds other data.
Make sure you have backups of the artifact store and any directories the server account can write to.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find MLflow servers and their versions.
- Upgrade past 2.9.2 using the release notes to pick a fixed build.
- Restrict network access and add authentication.
- Run the server under an account that can write only to the artifact directory.
- Verify that backups of the artifact store exist and can be restored.
Why it matters
The record classes this as CWE-22, path traversal. A user-supplied path was decoded twice, so a value that passed the first check changed into a traversal on the second decode.
The impact here is integrity and availability rather than disclosure: directories can be removed. That can wipe model artifacts or reach other data owned by the server account. Repeated variants of the same bug show why input handling should be centralised and tested. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How is this different from the file read issues?
This one deletes directories, while the others read files.
Which earlier CVE is mentioned?
CVE-2023-6831, a similar issue that the record says was not fully fixed.
Sources
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1560
Last reviewed: 19 October 2026.
