Skip to content

Fix artifact path traversal vector#19260

Merged
BenWilson2 merged 3 commits intomlflow:masterfrom
BenWilson2:artifact-traversal
Dec 10, 2025
Merged

Fix artifact path traversal vector#19260
BenWilson2 merged 3 commits intomlflow:masterfrom
BenWilson2:artifact-traversal

Conversation

@BenWilson2
Copy link
Member

@BenWilson2 BenWilson2 commented Dec 7, 2025 •
edited by github-actions bot
Loading

🛠 DevTools 🛠

Open in GitHub Codespaces

Install mlflow from this PR

# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19260/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/19260/merge#subdirectory=libs/skinny

For Databricks, use the following command:

%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s pull/19260/merge

Related Issues/PRs

#xxx

What changes are proposed in this pull request?

Prevent artifact path traversal attacks by validating paths when logging to a local filestore backend.

How is this PR tested?

  • Existing unit/integration tests
  • New unit/integration tests
  • Manual tests

Does this PR require documentation update?

  • No. You can skip the rest of this section.
  • Yes. I've updated:
    • Examples
    • API references
    • Instructions

Release Notes

Is this a user-facing change?

  • No. You can skip the rest of this section.
  • Yes. Give a description of this change to be included in the release notes for MLflow users.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

  • area/tracking: Tracking Service, tracking client APIs, autologging
  • area/models: MLmodel format, model serialization/deserialization, flavors
  • area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
  • area/scoring: MLflow Model server, model deployment tools, Spark UDFs
  • area/evaluation: MLflow model evaluation features, evaluation metrics, and evaluation workflows
  • area/gateway: MLflow AI Gateway client APIs, server, and third-party integrations
  • area/prompts: MLflow prompt engineering features, prompt templates, and prompt management
  • area/tracing: MLflow Tracing features, tracing APIs, and LLM tracing functionality
  • area/projects: MLproject format, project running backends
  • area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
  • area/build: Build and test infrastructure for MLflow
  • area/docs: MLflow documentation pages

How should the PR be classified in the release notes? Choose one:

  • rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
  • rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
  • rn/feature - A new user-facing feature worth mentioning in the release notes
  • rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
  • rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes should be selected for bug fixes, documentation updates, and other small changes. No should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

What is a minor/patch release?
  • Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
    Bug fixes, doc updates and new features usually go into minor releases.
  • Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
    Bug fixes and doc updates usually go into patch releases.
  • Yes (this PR will be cherry-picked and included in the next patch release)
  • No (this PR will be included in the next minor release)

Copilot AI review requested due to automatic review settings December 7, 2025 19:59
@github-actions github-actions bot added v3.7.1 area/tracking Tracking service, tracking client APIs, autologging rn/bug-fix Mention under Bug Fixes in Changelogs. labels Dec 7, 2025
Copilot AI reviewed Dec 7, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses a critical security vulnerability (ZDI-CAN-26649) that allowed directory traversal attacks through malicious meta.yaml files placed in artifact folders. The fix validates run directory structure before treating a directory as a valid run, preventing attackers from accessing files outside intended directories.

  • Adds run directory validation to check for required subdirectories (metrics/, params/, artifacts/)
  • Implements validation in _find_run_root() to reject invalid run directories
  • Includes comprehensive regression test demonstrating the blocked attack vector

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
mlflow/store/tracking/file_store.py Adds _is_valid_run_directory() method and integrates validation into _find_run_root() to prevent path traversal via malicious meta.yaml files in artifact folders
tests/store/tracking/test_file_store.py Adds regression test test_malicious_meta_yaml_in_artifact_folder_path_traversal() that verifies the attack scenario is properly blocked

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@BenWilson2 BenWilson2 added the team-review Trigger a team review request label Dec 7, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 7, 2025 •
edited
Loading

Documentation preview for 6fd7b94 is available at:

More info
  • Ignore this comment if this PR does not change the documentation.
  • The preview is updated when a new commit is pushed to this PR.
  • This comment was created by this workflow run.
  • The documentation was built by this workflow run.

@BenWilson2
fix gc logic
c897739 
Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
@BenWilson2
fix windows
2e02faa 
Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
serena-ruan
serena-ruan reviewed Dec 9, 2025
View reviewed changes
mlflow/store/tracking/file_store.py
FileStore.PARAMS_FOLDER_NAME,
FileStore.ARTIFACTS_FOLDER_NAME,
]
return all(is_directory(os.path.join(run_dir, subdir)) for subdir in required_subdirs)
Copy link
Collaborator

@serena-ruan serena-ruan Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if the attacker creates arbitrary folders for these?

Copy link
Member Author

@BenWilson2 BenWilson2 Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a FANTASTIC point! Let me go ahead and add some hardening to this to prevent this other mechanism. Thank you, @serena-ruan !!

@BenWilson2
Further hardening
6fd7b94 
Signed-off-by: Ben Wilson <benjamin.wilson@databricks.com>
serena-ruan
serena-ruan approved these changes Dec 10, 2025
View reviewed changes
Copy link
Collaborator

@serena-ruan serena-ruan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@BenWilson2 BenWilson2 added this pull request to the merge queue Dec 10, 2025
Merged via the queue into mlflow:master with commit 5bf2ec2 Dec 10, 2025
68 of 72 checks passed
@BenWilson2 BenWilson2 deleted the artifact-traversal branch December 10, 2025 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@serena-ruan serena-ruan serena-ruan approved these changes

@B-Step62 B-Step62 Awaiting requested review from B-Step62

@daniellok-db daniellok-db Awaiting requested review from daniellok-db

@harupy harupy Awaiting requested review from harupy

@kevin-lyn kevin-lyn Awaiting requested review from kevin-lyn

@TomeHirata TomeHirata Awaiting requested review from TomeHirata

@WeichenXu123 WeichenXu123 Awaiting requested review from WeichenXu123

@xq-yin xq-yin Awaiting requested review from xq-yin

Assignees

@serena-ruan serena-ruan

Labels

area/tracking Tracking service, tracking client APIs, autologging rn/bug-fix Mention under Bug Fixes in Changelogs. team-review Trigger a team review request v3.7.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@BenWilson2 @serena-ruan