CVE-2026-91771CWE-22path-traversal

CVE-2026-91771

High · published September 15, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01167 · 67.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-15T06:16Z
References (6)
https://github.com/wandb/wandb · [email protected]https://github.com/wandb/wandb/blob/v0.27.2/wandb/apis/public/files.py#L319-L347 · [email protected]https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6 · [email protected]https://github.com/wandb/wandb/issues/12592 · [email protected]https://github.com/wandb/wandb/releases/tag/v0.29.0 · [email protected]https://www.vulncheck.com/advisories/weights-biases-wandb-before-0.29.0-path-traversal-via-file-download · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 01:20Z
    Weights & Biases wandb before 0.29.0 Path Traversal via File Download
    cvelistv5