CyberRota Analysis
AI-GeneratedWeights & Biases wandb versions prior to 0.29.0 are vulnerable to path traversal attacks due to improper validation of file names in the File.download function. This flaw allows attackers with backend control to manipulate file paths, potentially leading to unauthorized file writes and code execution by altering shell startup files or Python import paths. Organizations using this software should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.