Language: Python
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
def _init_server(backend_uri, root_artifact_uri):
    """
    Launch a new REST server using the tracking store specified by backend_uri and root artifact
    directory specified by root_artifact_uri.
    :returns A tuple (url, process) containing the string URL of the server and a handle to the
             server process (a multiprocessing.Process object).
    """
    mlflow.set_tracking_uri(None)
    server_port = get_safe_port()
    process = Popen(
        [
            sys.executable,
            "-c",
            f'from mlflow.server import app; app.run("{LOCALHOST}", {server_port})',
        ],
        env={
            **os.environ,
            BACKEND_STORE_URI_ENV_VAR: backend_uri,
            ARTIFACT_ROOT_ENV_VAR: root_artifact_uri,
        },
    )

    _await_server_up_or_die(server_port)
    url = f"http://{LOCALHOST}:{server_port}"
    _logger.info(f"Launching tracking server against backend URI {backend_uri}. Server URL: {url}")
    return url, process