Search
Find a vulnerability
Search criteria
2 vulnerabilities found for wandb by wandb
CVE-2026-91771 (GCVE-0-2026-91771)
Vulnerability from nvd – Published: 2026-09-15 01:20 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Weights & Biases wandb before 0.29.0 Path Traversal via File Download
Summary
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wandb/wandb/issues/12592 | issue-tracking |
| https://github.com/wandb/wandb/commit/e52558f3a6a… | patch |
| https://github.com/wandb/wandb/releases/tag/v0.29.0 | release-notes |
| https://github.com/wandb/wandb/blob/v0.27.2/wandb… | technical-description |
| https://github.com/wandb/wandb | product |
| https://www.vulncheck.com/advisories/weights-bias… | third-party-advisory |
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:14:53.033262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:05.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/wandb",
"product": "wandb",
"vendor": "wandb",
"versions": [
{
"lessThan": "0.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Weights \u0026 Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:24.022Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/wandb/wandb/issues/12592"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6"
},
{
"name": "wandb v0.29.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wandb/wandb/releases/tag/v0.29.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wandb/wandb/blob/v0.27.2/wandb/apis/public/files.py#L319-L347"
},
{
"tags": [
"product"
],
"url": "https://github.com/wandb/wandb"
},
{
"name": "VulnCheck Advisory: Weights \u0026 Biases wandb before 0.29.0 Path Traversal via File Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/weights-biases-wandb-before-0.29.0-path-traversal-via-file-download"
}
],
"title": "Weights \u0026 Biases wandb before 0.29.0 Path Traversal via File Download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91771",
"datePublished": "2026-09-15T01:20:33.139Z",
"dateReserved": "2026-09-15T00:45:12.423Z",
"dateUpdated": "2026-09-24T14:22:24.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91771 (GCVE-0-2026-91771)
Vulnerability from cvelistv5 – Published: 2026-09-15 01:20 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Weights & Biases wandb before 0.29.0 Path Traversal via File Download
Summary
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wandb/wandb/issues/12592 | issue-tracking |
| https://github.com/wandb/wandb/commit/e52558f3a6a… | patch |
| https://github.com/wandb/wandb/releases/tag/v0.29.0 | release-notes |
| https://github.com/wandb/wandb/blob/v0.27.2/wandb… | technical-description |
| https://github.com/wandb/wandb | product |
| https://www.vulncheck.com/advisories/weights-bias… | third-party-advisory |
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:14:53.033262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:05.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/wandb",
"product": "wandb",
"vendor": "wandb",
"versions": [
{
"lessThan": "0.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Weights \u0026 Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:24.022Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/wandb/wandb/issues/12592"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6"
},
{
"name": "wandb v0.29.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wandb/wandb/releases/tag/v0.29.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wandb/wandb/blob/v0.27.2/wandb/apis/public/files.py#L319-L347"
},
{
"tags": [
"product"
],
"url": "https://github.com/wandb/wandb"
},
{
"name": "VulnCheck Advisory: Weights \u0026 Biases wandb before 0.29.0 Path Traversal via File Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/weights-biases-wandb-before-0.29.0-path-traversal-via-file-download"
}
],
"title": "Weights \u0026 Biases wandb before 0.29.0 Path Traversal via File Download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91771",
"datePublished": "2026-09-15T01:20:33.139Z",
"dateReserved": "2026-09-15T00:45:12.423Z",
"dateUpdated": "2026-09-24T14:22:24.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}