PT-2026-36853

CVE-2026-42075

Published

2026-04-22

Updated

2026-05-04

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3

Description A path traversal issue exists in the skill download (fetch) command. The --out= flag accepts user-provided paths without proper validation, allowing attackers to write files to arbitrary locations on the filesystem. This can lead to the overwriting of critical system files or the creation of files in sensitive locations.

Recommendations Update to version 1.69.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Xeloxa

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers