Evidence · DiggingBeagle record
MLflow model prompt-source traversal, GHSA-m65p-9j7q-6w33
Maintainer advisory showing how schemeless relative model-source paths can expose server-local artifacts.
- Source role
- primary disclosure
Evidence record
Maintainer advisory showing how schemeless relative model-source paths can expose server-local artifacts.
Claim-level citations (2)
- supportsMLflow prompt model-source paths could read server-local artifacts: The MLflow prompt-version advisory identifies relative model-source paths and a tag-presence condition that can lead to server-local artifact retrieval; 3.17.0 is the listed fixed version.
GHSA-m65p-9j7q-6w33: source URL validation, model version tag bypass, affected versions
- supportsMLflow prompt model-source paths could read server-local artifacts: An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server. A caller able to use the affected model-version artifact retrieval path must control its source metadata or trigger use of a crafted version. The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
GHSA-m65p-9j7q-6w33: source URL validation, model version tag bypass, affected versions