CVE-2026-75111: Evidently UI Path Traversal via Dataset Materialization Filename
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75111?
The severity of CVE-2026-75111 is rated high with a score of 7.5.
What is CVE-2026-75111 related to?
CVE-2026-75111 is related to a path traversal vulnerability in the Evidently UI's dataset materialization endpoint.
How can CVE-2026-75111 be exploited?
CVE-2026-75111 can be exploited by unauthenticated attackers who supply traversal sequences or absolute paths in the filename parameter.
What are the risks associated with CVE-2026-75111?
The risks associated with CVE-2026-75111 include unauthorized access to arbitrary files outside the workspace directory.
How do I fix CVE-2026-75111?
To fix CVE-2026-75111, ensure proper validation of the filename parameter to prevent path traversal attacks.