Mlflow before 2.2.1 is susceptible to local file inclusion due to path traversal \..\filename in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
id: CVE-2023-1177
info:
name: Mlflow <2.2.1 - Local File Inclusion
author: iamnoooob,pdresearch
...