CVE-2025-15036 | MLflow up to 3.8.x dbconnect_artifact_cache.py extract_archive_to_dir path traversal

A vulnerability categorized as critical has been discovered in MLflow up to 3.8.x. This issue affects the function extract_archive_to_dir of the file mlflow/pyfunc/dbconnect_artifact_cache.py. The manipulation results in path traversal: ‘..filename’.

This vulnerability was named CVE-2025-15036. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.