CVE-2024-2928
Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
- Published
- Jun 6, 2024
- Updated
- Aug 1, 2024
- Assigning CNA
- @huntr_ai
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NModerate · next 30 days
- Percentile
- 97.6%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
Sources
2- CVE-2024-2928Exploit
Arbitrary file read exploit for CVE-2024-2928 in mlflow
- sjtu_CVE-2024-2928Scanner
yasa扫描sjtu_CVE-2024-2928漏洞报告
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.