CVE-2025-15036: Max Severity Path Traversal in MLflow before 3.7.0

CVE-2025-15036 is a maximum severity path traversal flaw (CVSS 10.0) in MLflow versions before 3.7.0. The extract_archive_to_dir function does not validate tar member paths, so a crafted tar.gz archive can overwrite arbitrary files on the host. Upgrade to MLflow 3.7.0 or later and review who can supply archives.

What's affected

Per the CVE record, MLflow versions before 3.7.0 are affected. The vulnerable function is extract_archive_to_dir in mlflow/pyfunc/dbconnect_artifact_cache.py. Version 3.7.0 and later contain the fix.

The upstream fix is commit 3bf6d81, titled "Check security before extracting tar file" (pull request 19557). It adds a check before the archive is extracted. The record notes the sandbox escape risk applies in multi-tenant or shared cluster environments.

The code path involves Databricks Connect artifact caching, so installs that never use that feature are less exposed. Treat that as a reason to prioritize, not a reason to skip the upgrade.

How to check if you're exposed

Check the installed version in each environment:

pip show mlflow
python -c "import mlflow; print(mlflow.__version__)"

Anything below 3.7.0 is in scope. Check notebooks, job clusters, serving containers and CI images as separate places, because each can carry its own pinned copy.

In a requirements file or lockfile, search for the pin:

grep -rn "mlflow" requirements*.txt poetry.lock Pipfile.lock pyproject.toml

Also ask where tar.gz archives come from in your workflows, since the flaw needs an attacker-controlled archive.

What to do now

1. List every environment with MLflow and its version, including pinned lockfiles and base images.
2. Upgrade to 3.7.0 or later and rebuild any image that bundles the old version.
3. Test your Databricks Connect and pyfunc workflows after the upgrade, since the fix adds a check on archive contents.
4. In shared or multi-tenant clusters, review who can supply archives and tighten that access.
5. Run MLflow jobs with least privilege, so an overwritten file cannot reach credentials or system paths.

Why it matters

This is CWE-22, Path Traversal, together with CWE-29, which covers backslash style path escapes. Extraction code builds a destination from names inside the archive. Without a check that each result stays inside the target directory, an entry can climb out of it. The record says an attacker who controls the archive can overwrite files or gain elevated privileges.

The 10.0 score reflects a network vector with no privileges or interaction and a changed scope, meaning the damage can cross the boundary of the vulnerable component. It is not listed in CISA's Known Exploited Vulnerabilities catalog in the record. In practice the question is who can hand your MLflow code a tar file.

A fix that is already available

This is one of the easy ones: a released version exists and the change is an upgrade. The work is finding every copy. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MLflow fix commit 3bf6d81
• Red Hat CVE page for CVE-2025-15036

Last reviewed: 19 October 2026.