Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-6909

79
FAUCET Score

CVE-2023-6909 is a high-severity path traversal vulnerability affecting mlflow/mlflow versions prior to 2.9.2, allowing an unauthenticated attacker to access arbitrary files on the server. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network without user interaction, potentially leading to critical information disclosure. While not currently in CISA's KEV catalog, public Nuclei templates exist, and its high EPSS score and community discussion indicate a significant likelihood of future exploitation. SecurityWeek has also reported on this vulnerability as part of broader AI supply chain concerns.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.9.2CPE matchmatch criteria
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
89.72%
Probability of exploitation in next 30 days
EPSS Percentile
99.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-23
Model: v2026.06.15
Nuclei: CVE-2023-6909 · Feb 2, 2024
This CVE's current EPSS score of 0.8972 is in the 100th percentile among its peer group of 51,455 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: mlflowFixed in: 2.9.2

Vendor Advisories (1)

pipGHSA-5r3q-93q3-f978high

MLflow Path Traversal Vulnerability

Dec 20, 2023

References

github.com / mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1
Patch
huntr.com / bounties/11209efb-0f84-482f-add0-587ea6b7e850
ExploitPatchThird Party Advisory