CVE-2026-75111
Evidently UI Path Traversal via Dataset Materialization Filename
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 17, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 17, 2026
Description
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
evidentlyevidentlyai |
|
References
- GitHub Issue #1887issue-tracking
- https://github.com/evidentlyai/evidentlyproduct
- FileDataSource in src/evidently/ui/service/datasets/data_source.pytechnical-description
- VulnCheck Advisory: Evidently UI Path Traversal via Dataset Materialization Filenamethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.