CVE-2026-66007: Datasets Path Traversal via Unsanitized file_name Metadata
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal sequences to read arbitrary local files, which are then embedded into output when savetodisk or pushtohub is called.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datasets folder-based dataset buildersto a version that resolves this vulnerability.Fixed in 5.0.0Patch f989ef9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66007?
CVE-2026-66007 has a medium severity rating with a score of 6.5.
How do I fix CVE-2026-66007?
To fix CVE-2026-66007, update to the version that includes the patch identified by commit f989ef9.
What type of vulnerability is CVE-2026-66007?
CVE-2026-66007 is a path traversal vulnerability affecting folder-based dataset builders.
What software is affected by CVE-2026-66007?
CVE-2026-66007 affects the Datasets software version up to 5.0.0.
What attack vector is associated with CVE-2026-66007?
CVE-2026-66007 can be exploited by attackers sending crafted file_name values with directory traversal sequences.