CVE-2025-15031: Critical Path Traversal in MLflow pyfunc

CVE-2025-15031 is a critical path traversal bug (CVSS 9.1) in MLflow's pyfunc extraction code. Crafted tar.gz archives can write files outside the intended directory. The record does not name a fixed version, so check MLflow's releases and advisory, upgrade, and avoid loading untrusted artifacts.

What's affected

The record says the issue affects the latest version of MLflow at the time of disclosure and does not give a version range. The affected component is the pyfunc extraction process, which unpacks tar archives.

The record does not state a fixed version, and the sources I fetched (Red Hat's CVE page, which repeats the CVE description) do not either. Check the MLflow GitHub releases and security advisories for the release that fixes it, and do not rely on a version guess.

Related note: CVE-2025-15036 is a separate tar extraction bug in a different MLflow function, fixed before version 3.7.0. Having that fix does not prove this one is fixed.

How to check if you're exposed

Find the installed version and where MLflow runs:

pip show mlflow
pip list 2>/dev/null | grep -i mlflow

For containers, scan the image or run pip show mlflow inside it. Then look at how artifacts reach your MLflow code. The risk is highest where tar.gz artifacts come from places you do not control: shared tracking servers, model registries that accept uploads, or multi-tenant platforms.

Make a list of who can upload artifacts and which services unpack them.

What to do now

1. Locate every MLflow install, including notebooks, serving containers and CI images.
2. Check MLflow's advisory and release notes for the fix, then upgrade to a release that contains it.
3. Until then, load model artifacts only from sources you trust and restrict who can upload to your tracking server and registry.
4. Run MLflow services as an unprivileged user with a write-limited filesystem, so a stray file write has less to hit.
5. Rescan after upgrading to confirm the old version is gone from every image.

Why it matters

The class is CWE-22, Path Traversal. Python's tarfile.extractall trusts the paths inside an archive. If an entry contains parent directory markers or an absolute path, the file lands outside the folder the code meant to use. The record describes the consequence as arbitrary file overwrite and potentially remote code execution, since overwriting a script or config that later runs is often enough.

The CVSS vector is network based, with no privileges or user interaction (9.1), though real exposure depends on whether untrusted archives reach this code. The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog. Multi-tenant ML platforms are the realistic worry, because one tenant's artifact is another tenant's input.

Telling reachable from theoretical

Many MLflow installs never touch the vulnerable path. Reachability analysis narrows a long list to the services where untrusted archives actually flow, which is the list that needs the first upgrade. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Red Hat CVE page for CVE-2025-15031

Last reviewed: 19 October 2026.