[GHSA-f2m9-wcf4-cwwx] MLFlow Creates a Temporary File With Insecure Permissions

[Chi-Song-Owen]

Updates

• References

Comments

Summary

Add bd8854fb2b4b168a4384ebddc6c4a0b5d56aff01 as the
vulnerability-introducing commit for GHSA-f2m9-wcf4-cwwx.

Although the commit title is "Fix temp directory permission issue on
worker side", it fixes a Spark worker accessibility issue rather than
a security vulnerability. In doing so, it introduces the insecure
permissions described by this advisory.

Evidence

Before this commit, tempfile.mkdtemp() created the relevant temporary
directories with its secure default permission mode of 0o700.

The commit explicitly added os.chmod(..., 0o777) in the following
relevant locations:

• mlflow/utils/file_utils.py: get_or_create_nfs_tmp_dir()
• mlflow/pyfunc/__init__.py: _create_model_downloading_tmp_dir()

These are the same two temporary-directory creation paths identified in
GHSA-f2m9-wcf4-cwwx. Changing their permissions from 0o700 to 0o777
made the directories writable by non-owner users, enabling local users
to tamper with downloaded model artifacts.

The relationship is also confirmed by the remediation history:

• Commit 1d7c8d4cf0a67d407499a8a4ffac387ea4f8194a, associated with
  CVE-2025-10279 / GHSA-4x5p-f36r-mxxr, changed only
  get_or_create_tmp_dir() from 0o777 to 0o750, leaving the NFS and
  model-downloading paths insufficiently protected.
• The fixing commit already referenced by this advisory,
  1dcbb0c2fbd1f446c328830e601ca13a28219b8a, finally changed
  get_or_create_nfs_tmp_dir() from 0o777 to 0o750 and
  _create_model_downloading_tmp_dir() from 0o770 to 0o750.

Therefore, bd8854fb2b4b168a4384ebddc6c4a0b5d56aff01 is the source-level
commit that originally introduced the insecure permission changes
underlying this advisory.