CVE-2026-91771
Published:September 15, 2026
Updated:September 22, 2026
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
Affected Packages
wandb (CONDA):
Affected version(s) >=0.9.3 <0.29.0Fix Suggestion:
Update to version 0.29.0https://github.com/wandb/wandb.git (GITHUB):
Affected version(s) >=v0.17.0 <v0.29.0Fix Suggestion:
Update to version v0.29.0wandb (PYTHON):
Affected version(s) >=0.1.0 <0.29.0Fix Suggestion:
Update to version 0.29.0Related Resources (7)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS
Base Score:
0.73