Vulnerability Description
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/wandb/wandb
- https://github.com/wandb/wandb/blob/v0.27.2/wandb/apis/public/files.py#L319-L347
- https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6
- https://github.com/wandb/wandb/issues/12592
- https://github.com/wandb/wandb/releases/tag/v0.29.0
- https://www.vulncheck.com/advisories/weights-biases-wandb-before-0.29.0-path-tra
FAQ
What is CVE-2026-91771?
CVE-2026-91771 is a vulnerability with a CVSS score of 8.8 (HIGH). Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply ...
How severe is CVE-2026-91771?
CVE-2026-91771 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91771?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.