CVE-2025-15031 - Vulnerability Analysis

Overview

MLflow contains an unrestricted file upload caused by improper path validation in tarfile.extractall during pyfunc extraction, letting attackers write arbitrary files and potentially execute code remotely, exploit requires crafted tar.gz files.

Severity & Score

Impact

Attackers can overwrite arbitrary files and potentially execute code remotely, risking full system compromise in multi-tenant or untrusted artifact scenarios.

Mitigation

Update to the latest version of MLflow.

References

• https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🟠 CVE-2025-15031 - High (8.1) A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15031/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner