Description

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T21:16:50.193Z",
  "pubdate": "2026-08-17T21:16:50.193Z",
  "executiveSummary": "An arbitrary file read vulnerability exists within the Evidently UI dataset materialization endpoint, allowing unauthenticated remote threat actors to bypass workspace boundaries and access sensitive system files. The vulnerability stems from improper input validation of the filename parameter, which fails to adequately sanitize directory traversal sequences or absolute paths. Successful exploitation enables malicious actors to supply crafted path parameters to read arbitrary files from the underlying operating system. These unauthorized files are subsequently processed and materialized into datasets, allowing the attacker to retrieve the sensitive data through the application download endpoint. This flaw poses a severe risk to confidentiality, potentially exposing credentials, configuration data, and system files. The attack can be executed over the network without requiring any prior authentication or privileged access. Remediation requires robust input validation and path sanitization within the dataset materialization component to ensure all file operations remain strictly confined to the designated workspace directory.",
  "technicalDetails": "The vulnerability resides in the Evidently UI dataset materialization endpoint, specifically within the handling of the filename parameter. The root cause of the security defect is insufficient input validation and a lack of proper canonicalization checks, which permits the processing of directory traversal sequences (such as dot-dot-slash) or fully qualified absolute paths. Attackers can leverage this flaw by sending an unauthenticated HTTP request to the dataset materialization endpoint, supplying a manipulated filename parameter containing path traversal payloads directed at critical system files outside the intended workspace directory. Upon receiving the payload, the vulnerable component attempts to materialize the specified file into a dataset without verifying whether the target file resides within the authorized directory boundary. Once the arbitrary file is materialized into a dataset, the attacker can leverage the application download endpoint to retrieve the contents of the file, thereby completing the data exfiltration chain. The exploitation vector is network-accessible and requires zero authentication or user interaction, granting unprivileged external attackers the capability to read any file readable by the user context running the Evidently UI process. The post-exploitation impact includes the potential exposure of sensitive application configurations, environment variables, system credentials, and internal source code, severely compromising the overall security posture of the host system."
}