A remote code execution vulnerability was discovered in the MLflow Tracking Server, specifically in its handling of model file paths during model creation. An attacker can exploit this flaw to run arbitrary code with the service account's privileges by submitting a maliciously crafted user-supplied path. This vulnerability allows an attacker to execute code without authentication, posing a significant risk to systems using MLflow. The Nuclei template for exploiting this vulnerability has been published, making it essential for users to apply the necessary patches or mitigations to prevent exploitation.