---
id: CVE-2026-75111
title: Evidently UI Path Traversal via Dataset Materialization Filename
summary: >-
  Evidently UI fails to properly validate the filename parameter in the dataset
  materialization endpoint, allowing unauthenticated attackers to read arbitrary
  files outside the workspace directory. Attackers can supply traversal
  sequences …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: evidentlyai
product: evidently
affected:
  - evidently <= 0.7.21
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-20T13:48:27.310608Z'
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:19:23.937Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75111'
references:
  - url: 'https://github.com/evidentlyai/evidently/issues/1887'
    label: 'GitHub Issue #1887'
  - url: 'https://github.com/evidentlyai/evidently'
  - url: >-
      https://github.com/evidentlyai/evidently/blob/main/src/evidently/ui/service/datasets/data_source.py
    label: FileDataSource in src/evidently/ui/service/datasets/data_source.py
  - url: >-
      https://www.vulncheck.com/advisories/evidently-ui-path-traversal-via-dataset-materialization-filename
    label: >-
      VulnCheck Advisory: Evidently UI Path Traversal via Dataset
      Materialization Filename
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.32938
ingestedAt: '2026-09-24T15:45:56.703Z'
---

## Overview

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

## Affected

- `evidently <= 0.7.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.