CVE-2026-42075

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42075", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T19:17:30.565Z", "datePublished": "2026-05-04T16:47:23.943Z", "dateUpdated": "2026-05-04T17:15:13.381Z"}, "containers": {"cna": {"title": "Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j"}, {"name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"version": "< 1.69.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:47:23.943Z"}, "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3."}], "source": {"advisory": "GHSA-r466-rxw4-3j9j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T17:14:53.252083Z", "id": "CVE-2026-42075", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T17:15:13.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42075", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T17:14:53.252083Z"}}}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T17:15:10.300Z"}}], "cna": {"title": "Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write", "source": {"advisory": "GHSA-r466-rxw4-3j9j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "EvoMap", "product": "evolver", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "references": [{"url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j", "name": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "name": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T16:47:23.943Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42075", "state": "PUBLISHED", "dateUpdated": "2026-05-04T17:15:13.381Z", "dateReserved": "2026-04-23T19:17:30.565Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T16:47:23.943Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "evolver", "vendor": "EvoMap", "versions": [{"status": "affected", "version": "< 1.69.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3."}, {"lang": "es", "value": "Evolver es un motor autoevolutivo impulsado por GEP para agentes de IA. Antes de la versi\u00f3n 1.69.3, una vulnerabilidad de salto de ruta en el comando de descarga de habilidades (fetch) permite a los atacantes escribir archivos en ubicaciones arbitrarias del sistema de archivos. El indicador --out= acepta rutas proporcionadas por el usuario sin validaci\u00f3n, lo que permite ataques de salto de directorio que pueden sobrescribir archivos cr\u00edticos del sistema o crear archivos en una ubicaci\u00f3n sensible. Este problema ha sido parcheado en la versi\u00f3n 1.69.3."}], "id": "CVE-2026-42075", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42075", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T17:14:53.252083Z", "version": "2.0.3"}}]}, "published": "2026-05-04T17:16:24.283", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/releases/tag/v1.69.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.69.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "evolver", "source": "cna", "vendor": "EvoMap"}, "product": "evolver", "vendor": "evomap"}], "created": "2026-05-04T18:30:06.105343+00:00", "updated": "2026-05-04T19:44:02.340935+00:00", "vendors": ["evomap", "evomap$PRODUCT$evolver"]}