CVE-2026-75111

Name of the Vulnerable Software and Affected Versions Evidently UI (affected versions not specified)

Description An issue exists where the software fails to properly validate the filename parameter in the dataset materialization endpoint. This allows unauthenticated attackers to read arbitrary files outside the workspace directory by using traversal sequences or absolute paths. These system files are then materialized into datasets and can be retrieved via the download endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.