EUVD-2026-60390
GHSA-cjrm-54c2-4w78
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network exploitation with high confidentiality impact only; no integrity or availability impact; scope unchanged as breach is confined to the application's own filesystem context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.
AnalysisAI
Path traversal in Evidently UI's dataset materialization endpoint exposes arbitrary host filesystem files to unauthenticated remote attackers. The filename parameter in the materialization API is unsanitized, enabling directory traversal sequences or absolute paths to escape the workspace directory; the materialized file is then retrievable via the download endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the Evidently UI service being network-reachable by the attacker - the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms unauthenticated, low-complexity exploitation against default configurations of Evidently UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.7 and accurately reflects the threat model: unauthenticated, low-complexity network exploitation with full confidentiality impact and no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers an internet-exposed Evidently UI instance and sends a crafted POST request to the dataset materialization endpoint with a filename parameter set to a traversal path such as '../../../../etc/passwd' or an absolute path like '/home/mluser/.ssh/id_rsa'. The server reads the target file and materializes it as a dataset object. … |
| Remediation | No vendor-released patch has been identified at time of analysis; monitor the GitHub issue at https://github.com/evidentlyai/evidently/issues/1887 and the VulnCheck advisory for an upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Evidently UI, implement network-level access restrictions to limit exposure of the materialization endpoint, and review logs for unauthorized access attempts using path traversal patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today