CVE-2026-75111: unauth path traversal leaks any file

CISO Take

A path traversal flaw in Evidently UI's dataset materialization endpoint lets an unauthenticated attacker submit traversal sequences or absolute paths in the filename parameter to read arbitrary files from the host filesystem, then retrieve the contents via the download endpoint. This is a network-exploitable, zero-privilege, zero-interaction bug (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) against a widely used ML observability/monitoring tool, meaning any exposed instance is a straightforward credential and secrets-harvesting target — SSH keys, cloud IAM tokens, .env files, and config secrets are all fair game. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not confirmed under active exploitation, but the technique requires no special AI/ML knowledge and is trivial to weaponize once an instance is found. Inventory any Evidently UI deployments, confirm whether the service is internet-facing, and if so pull it behind authentication/VPN immediately while you track the vendor's patched release (see evidentlyai/evidently issue #1887); in the interim, monitor materialization/download endpoint logs for `../` sequences or absolute paths in filename parameters and run the service account with least-privilege filesystem access so a successful read can't reach high-value secrets.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Exploitability is trivial: no authentication, no user interaction, low attack complexity, network-reachable. Impact is confined to confidentiality (C:H/I:N/A:N) but severe in practice — arbitrary file read on the host can expose credentials, SSH keys, cloud tokens, and application secrets, which frequently enables lateral movement well beyond the vulnerable component. Real-world exposure is unconfirmed: no CISA KEV listing, no EPSS score, no public exploit code, and no Nuclei template exist, so there's no evidence of in-the-wild scanning yet. The deciding factor for actual risk is exposure — Evidently UI instances that are internet-facing or reachable from low-trust network segments (common in collaborative MLOps setups) carry high real risk; instances kept strictly internal and access-controlled are lower risk despite the CVSS score.

How does the attack unfold?

Discovery

Attacker locates an internet-exposed Evidently UI instance and identifies its dataset materialization endpoint.

AML.T0006

Exploitation

Attacker submits a path traversal or absolute-path payload in the filename parameter to the unauthenticated materialization endpoint.

AML.T0049

Collection

The targeted file outside the workspace directory is read from the host filesystem and materialized into a dataset object.

AML.T0037

Exfiltration

Attacker retrieves the materialized dataset via the download endpoint, obtaining the full contents of the arbitrary file.

AML.T0025

Discovery

Attacker locates an internet-exposed Evidently UI instance and identifies its dataset materialization endpoint.

AML.T0006

Exploitation

Attacker submits a path traversal or absolute-path payload in the filename parameter to the unauthenticated materialization endpoint.

AML.T0049

Collection

The targeted file outside the workspace directory is read from the host filesystem and materialized into a dataset object.

AML.T0037

Exfiltration

Attacker retrieves the materialized dataset via the download endpoint, obtaining the full contents of the arbitrary file.

AML.T0025

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Check evidentlyai/evidently's repository and the VulnCheck advisory for the patched release and upgrade immediately. 2) Until patched, do not expose the Evidently UI service directly to the internet — place it behind a VPN, reverse proxy with authentication, or restrict network access to trusted IP ranges. 3) As a stopgap, validate/sanitize the filename parameter server-side (reject .., leading /, and absolute paths) if you can apply a local patch or WAF rule. 4) Run the Evidently UI process with a minimal-privilege service account so even a successful traversal can't reach high-value secrets (SSH keys, cloud credential files, .env). 5) Add detection: alert on materialization/download requests containing ../, %2e%2e, or absolute path patterns in the filename parameter, and review recent access logs for anomalous file requests.

How is it classified?

Data Leakage Privacy Violation Training Data Framework AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 - AI system data and security controls

NIST AI RMF

MANAGE 4.1 - AI system risk treatment and monitoring

Frequently Asked Questions

What is CVE-2026-75111?

A path traversal flaw in Evidently UI's dataset materialization endpoint lets an unauthenticated attacker submit traversal sequences or absolute paths in the filename parameter to read arbitrary files from the host filesystem, then retrieve the contents via the download endpoint. This is a network-exploitable, zero-privilege, zero-interaction bug (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) against a widely used ML observability/monitoring tool, meaning any exposed instance is a straightforward credential and secrets-harvesting target — SSH keys, cloud IAM tokens, .env files, and config secrets are all fair game. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not confirmed under active exploitation, but the technique requires no special AI/ML knowledge and is trivial to weaponize once an instance is found. Inventory any Evidently UI deployments, confirm whether the service is internet-facing, and if so pull it behind authentication/VPN immediately while you track the vendor's patched release (see evidentlyai/evidently issue #1887); in the interim, monitor materialization/download endpoint logs for `../` sequences or absolute paths in filename parameters and run the service account with least-privilege filesystem access so a successful read can't reach high-value secrets.

Is CVE-2026-75111 actively exploited?

No confirmed active exploitation of CVE-2026-75111 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75111?

1) Check evidentlyai/evidently's repository and the VulnCheck advisory for the patched release and upgrade immediately. 2) Until patched, do not expose the Evidently UI service directly to the internet — place it behind a VPN, reverse proxy with authentication, or restrict network access to trusted IP ranges. 3) As a stopgap, validate/sanitize the filename parameter server-side (reject `..`, leading `/`, and absolute paths) if you can apply a local patch or WAF rule. 4) Run the Evidently UI process with a minimal-privilege service account so even a successful traversal can't reach high-value secrets (SSH keys, cloud credential files, `.env`). 5) Add detection: alert on materialization/download requests containing `../`, `%2e%2e`, or absolute path patterns in the filename parameter, and review recent access logs for anomalous file requests.

What systems are affected by CVE-2026-75111?

This vulnerability affects the following AI/ML architecture patterns: ML monitoring/observability pipelines, MLOps dashboards, ml data pipelines.

What is the CVSS score for CVE-2026-75111?

CVE-2026-75111 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

ML monitoring/observability pipelinesMLOps dashboardsml data pipelines

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

Exploitation Scenario

An attacker scans for internet-exposed Evidently UI instances (e.g., via search engines like Shodan/Censys or internal network reconnaissance after gaining a foothold). Finding one, they send an unauthenticated request to the dataset materialization endpoint with the filename parameter set to a traversal payload such as `../../../../etc/passwd` or an absolute path like `/root/.ssh/id_rsa` or `/app/.env`. The service reads the targeted file and materializes it as a dataset object without validating that the path stays within the workspace directory. The attacker then calls the download endpoint for that materialized dataset and retrieves the full file contents — harvesting credentials, private keys, or configuration secrets without ever authenticating to the system.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.