CVE-2024-3848

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.

• CWE-29
• CWE-22

• https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8Patch
• https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610Exploit, Issue Tracking, Third Party Advisory
• https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8Patch
• https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610Exploit, Issue Tracking, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38473Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 a…8.1
• CVE-2024-38474Substitution encoding issue in mod_rewrite in Apache HTTP Se…9.8
• CVE-2024-38475Improper escaping of output in mod_rewrite in Apache HTTP Se…9.1
• CVE-2024-38476Vulnerability in core of Apache HTTP Server 2.4.59 and earli…9.8
• CVE-2024-38477null pointer dereference in mod_proxy in Apache HTTP Server …7.5
• CVE-2024-38479Improper Input Validation vulnerability in Apache Traffic Se…7.5
• CVE-2024-38480"Piccoma" App for Android and iOS versions prior to 6.20.0 u…4
• CVE-2024-38481Dell iDRAC Service Module version 5.3.0.0 and prior, contain…4.4
• CVE-2024-38482CloudLink, versions 7.1.x and 8.x, contain an Improper check…7.2
• CVE-2024-38483Dell BIOS contains an Improper Input Validation vulnerabilit…6.7
• CVE-2024-38485Dell ECS, versions prior to 3.8.0, contain(s) a Host Header …4.3
• CVE-2024-38486Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through …8.8