CVE-2025-11201 is a critical (9.8) directory traversal flaw in the MLflow Tracking Server that can lead to remote code execution. The cause is unvalidated model file paths. A fix commit adds source validation. Upgrade once you confirm the release, and restrict who can reach the server.
What's affected
The record names the MLflow Tracking Server and does not list a version range. The problem sits in how a model file path is handled when a model version is created.
CVSS 9.8 (critical severity), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Zero Day Initiative advisory for the same flaw scores it 8.1 and marks attack complexity as high.
Fixed versions: the ZDI advisory says MLflow has issued an update and links a commit. Check the MLflow release notes for the first release that contains it.
How to check if you're exposed
Find your MLflow version, and check whether anything limits the source of new model versions.
pip show mlflow
echo "$MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX"
An empty second line means no source validation is set. Also review registry activity for model versions whose source is not an artifact location you recognise.
For the inventory side, the free in-browser scan at gold.safeguard.sh/scan can list packages from a requirements file and show known issues against them.
What to do now
- Find the first MLflow release that contains the fix commit in the release notes, then upgrade to it or later.
- Set the model version source validation environment variable to a pattern that matches only your own artifact locations. The documentation in the fix commit gives examples.
- Do not expose the tracking server to the internet. Require authentication in front of it.
- Run the server as an unprivileged account with a narrow file system view.
- Review model registry entries for sources you cannot explain.
Why it matters
The record classes this as CWE-22 (path traversal). A path supplied in a request is used in file operations without being checked, so it can point outside the place the server meant to use.
Because model files can be loaded and run by the systems that consume them, a bad source for a model version is a code execution risk, not just a file read. The ZDI advisory describes execution in the context of the service account. The record does not mark this as on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which MLflow release fixes this?
The advisory links a commit but does not name a release. Check the MLflow release notes for the first release that contains it.
Does source validation replace upgrading?
No. It narrows what the server accepts and is a good hardening step, but upgrade as well.
Sources
Last reviewed: 19 October 2026.
