CyberRota Analysis
AI-GeneratedThe vulnerability in Evidently UI allows unauthenticated attackers to exploit improper validation of the filename parameter in the dataset materialization endpoint, enabling them to read arbitrary files outside the designated workspace directory. By leveraging directory traversal sequences or absolute paths, attackers can access sensitive system files, posing a significant risk of data exposure. Organizations using Evidently UI should prioritize patching this vulnerability to safeguard their systems against potential unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.