CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.

Attacker scans cloud environments for MLflow Tracking Servers on default ports (5000/5001) using Shodan or targeted AWS/GCP enumeration. Sends a crafted HTTP POST to the model file creation endpoint with a path traversal payload (e.g., '../../etc/cron.d/backdoor' or a writable path outside the intended directory) to drop an arbitrary file on the server filesystem. No credentials or prior access required. Payload writes a reverse shell cron job or web shell. Attacker gains code execution as the MLflow service account and immediately queries the cloud metadata endpoint for IAM credentials, then exfiltrates model weights, training data, and stored experiment artifacts. Full attack chain executable in under five minutes with a basic proof-of-concept script.