Path Traversal Vulnerability in mlflow/mlflow

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.

N/A

路径遍历：’..filename’

MLflow 安全漏洞

MLflow是MLflow开源的一个简化机器学习开发的平台，包括跟踪实验、将代码打包成可重复的运行以及共享和部署模型。 MLflow 3.7.0之前版本存在安全漏洞，该漏洞源于extract_archive_to_dir函数在提取过程中未验证tar成员路径，可能导致路径遍历攻击，进而覆盖任意文件或提升权限。

N/A

N/A