CVE-2026-75111: Evidently UI Path Traversal Vulnerability

CVE-2026-75111 Overview

CVE-2026-75111 is a path traversal vulnerability [CWE-22] in the Evidently UI dataset materialization endpoint. The application fails to validate the filename parameter, allowing unauthenticated attackers to supply traversal sequences or absolute paths. The server then materializes arbitrary files from outside the workspace directory into datasets and returns them through the download endpoint.

Exploitation requires no authentication, no user interaction, and only network access to the Evidently UI service. Successful attacks disclose sensitive files including configuration data, credentials, and system files readable by the Evidently service account.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host, including secrets and configuration, by abusing the dataset materialization workflow.

Affected Products

Evidently AI - Evidently UI (open-source ML observability platform)
Deployments exposing the dataset materialization endpoint defined in src/evidently/ui/service/datasets/data_source.py
Self-hosted Evidently UI instances reachable over the network

Discovery Timeline

2026-08-17 - CVE-2026-75111 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75111

Vulnerability Analysis

Evidently UI exposes a dataset materialization endpoint that accepts a filename parameter from the client. The service uses this value to locate and load a file into a materialized dataset without confining the resolved path to the intended workspace directory. Attackers submit relative traversal sequences such as ../../../../etc/passwd or absolute paths to reference files outside the sandbox.

The materialized dataset is then retrievable through the download endpoint. This turns a local file into attacker-controlled content in an HTTP response. Because the endpoint requires no authentication, any network-reachable Evidently UI deployment is exposed.

The issue is tracked in the upstream project through GitHub Issue #1887 and detailed in the VulnCheck Advisory on Evidently UI.

Root Cause

The root cause is missing input validation and path canonicalization on the filename parameter in the dataset data source handler. The affected code path in data_source.py does not reject traversal sequences, does not reject absolute paths, and does not verify that the resolved absolute path resides inside the workspace root before opening the file.

Attack Vector

An attacker sends an HTTP request to the dataset materialization endpoint with a crafted filename value pointing outside the workspace. The server materializes the target file into a dataset object. The attacker then calls the corresponding download endpoint to retrieve the raw contents. The vulnerability manifests entirely in the file resolution logic; no authentication, tokens, or user interaction are required.

Refer to the Evidently source code and the VulnCheck advisory for endpoint specifics.

Detection Methods for CVE-2026-75111

Indicators of Compromise

HTTP requests to the Evidently dataset materialization endpoint containing traversal patterns such as ../, ..\, URL-encoded variants (%2e%2e%2f), or absolute paths in the filename parameter
Access log entries referencing sensitive host paths such as /etc/passwd, /proc/self/environ, .env, id_rsa, or Windows paths like C:\Windows\win.ini
Unexpected dataset objects in the Evidently workspace whose source path resolves outside the configured workspace directory
Download endpoint responses returning non-dataset content types or binary blobs shortly after materialization calls

Detection Strategies

Inspect Evidently UI application logs for materialization requests whose filename value fails a strict allowlist of workspace-relative paths
Deploy WAF or reverse proxy rules that block traversal sequences and absolute paths in query parameters and JSON bodies targeting Evidently endpoints
Correlate unauthenticated requests to materialization and download endpoints from the same client within a short time window

Monitoring Recommendations

Forward Evidently UI HTTP access logs and application logs to a centralized log platform for retention and query
Alert on repeated 200 responses to the materialization endpoint from unauthenticated sources, especially from external networks
Monitor file read syscalls by the Evidently service account for access outside the configured workspace directory using host-level auditing

How to Mitigate CVE-2026-75111

Immediate Actions Required

Restrict network exposure of the Evidently UI service to trusted networks only, and place it behind an authenticating reverse proxy
Audit Evidently workspaces and access logs for evidence of prior traversal attempts or unexpected dataset sources
Rotate any secrets, tokens, or credentials that may have been readable by the Evidently service account on affected hosts
Track upstream remediation progress via GitHub Issue #1887 and apply vendor patches when available

Patch Information

At the time of NVD publication, refer to the Evidently project repository and the VulnCheck advisory for the latest fixed version guidance. Upgrade Evidently UI to the version identified by the maintainers as containing the validation fix for the dataset materialization filename parameter.

Workarounds

Block requests to the dataset materialization and download endpoints at a reverse proxy until the service is patched
Enforce a strict allowlist of workspace-relative filenames at a proxy layer, rejecting any request containing .., URL-encoded traversal, backslashes, or leading /
Run the Evidently UI process as an unprivileged user in a container with a read-only filesystem and a narrow bind mount limited to the workspace directory
Apply mandatory access controls (AppArmor, SELinux, or seccomp) to constrain file reads by the Evidently process to the workspace path

bash

# Example NGINX rule blocking traversal in Evidently requests
location /api/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|/etc/|/proc/|^/[A-Za-z]:)") {
        return 403;
    }
    proxy_pass http://evidently_upstream;
}