CVE-2026-75111

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75111", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-17T17:28:41.677Z", "datePublished": "2026-08-17T20:36:04.764Z", "dateUpdated": "2026-09-24T14:19:23.937Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:23.937Z"}, "datePublic": "2026-06-15T00:00:00.000Z", "title": "Evidently UI Path Traversal via Dataset Materialization Filename", "descriptions": [{"lang": "en", "value": "Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "evidentlyai", "product": "evidently", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/evidently", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.7.21", "versionType": "custom"}], "repo": "https://github.com/evidentlyai/evidently"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/evidentlyai/evidently/issues/1887", "tags": ["issue-tracking"], "name": "GitHub Issue #1887"}, {"url": "https://github.com/evidentlyai/evidently", "tags": ["product"]}, {"url": "https://github.com/evidentlyai/evidently/blob/main/src/evidently/ui/service/datasets/data_source.py", "tags": ["technical-description"], "name": "FileDataSource in src/evidently/ui/service/datasets/data_source.py"}, {"name": "VulnCheck Advisory: Evidently UI Path Traversal via Dataset Materialization Filename", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/evidently-ui-path-traversal-via-dataset-materialization-filename"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T13:48:27.310608Z", "id": "CVE-2026-75111", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:24:29.705Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T13:48:27.310608Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:48:28.308Z"}}], "cna": {"title": "Evidently UI Path Traversal via Dataset Materialization Filename", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/evidentlyai/evidently", "vendor": "evidentlyai", "product": "evidently", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.7.21"}], "packageURL": "pkg:pypi/evidently", "defaultStatus": "unaffected"}], "datePublic": "2026-06-15T00:00:00.000Z", "references": [{"url": "https://github.com/evidentlyai/evidently/issues/1887", "name": "GitHub Issue #1887", "tags": ["issue-tracking"]}, {"url": "https://github.com/evidentlyai/evidently", "tags": ["product"]}, {"url": "https://github.com/evidentlyai/evidently/blob/main/src/evidently/ui/service/datasets/data_source.py", "name": "FileDataSource in src/evidently/ui/service/datasets/data_source.py", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/evidently-ui-path-traversal-via-dataset-materialization-filename", "name": "VulnCheck Advisory: Evidently UI Path Traversal via Dataset Materialization Filename", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:23.937Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75111", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:19:23.937Z", "dateReserved": "2026-08-17T17:28:41.677Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-17T20:36:04.764Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/evidently", "product": "evidently", "repo": "https://github.com/evidentlyai/evidently", "vendor": "evidentlyai", "versions": [{"lessThanOrEqual": "0.7.21", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint."}, {"lang": "es", "value": "Evidentemente, la interfaz de usuario no valida correctamente el par\u00e1metro filename en el endpoint de materializaci\u00f3n de conjuntos de datos, lo que permite a atacantes no autenticados leer archivos arbitrarios fuera del directorio del espacio de trabajo. Los atacantes pueden proporcionar secuencias de recorrido o rutas absolutas en el campo filename para acceder a archivos del sistema, los cuales son luego materializados en conjuntos de datos y recuperados a trav\u00e9s del endpoint de descarga."}], "id": "CVE-2026-75111", "lastModified": "2026-10-23T16:10:00.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75111", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T13:48:27.310608Z", "version": "2.0.3"}}]}, "published": "2026-08-17T21:16:50.193", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/evidentlyai/evidently"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/evidentlyai/evidently/blob/main/src/evidently/ui/service/datasets/data_source.py"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/evidentlyai/evidently/issues/1887"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/evidently-ui-path-traversal-via-dataset-materialization-filename"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.7.21]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "evidently", "source": "cna", "vendor": "evidentlyai"}, "product": "evidently", "vendor": "evidentlyai"}], "created": "2026-08-17T22:00:03.832685+00:00", "updated": "2026-08-21T12:39:33.342848+00:00", "vendors": ["evidentlyai", "evidentlyai$PRODUCT$evidently"]}