CVE-2026-91771: Weights & Biases wandb Path Traversal Flaw

CVE-2026-91771 Overview

CVE-2026-91771 is a path traversal vulnerability [CWE-22] in the Weights & Biases wandb Python client before version 0.29.0. The File.download function fails to validate file names returned by the backend server. A malicious or compromised backend can supply file names containing directory traversal sequences such as ../. This causes the client to write files outside the intended download directory on the user's machine. Attackers can leverage the write primitive to modify shell startup files or Python import paths, leading to code execution in the context of the user running wandb.

Critical Impact
A backend-controlled path traversal in a widely used machine learning experiment tracking client enables arbitrary file writes and downstream code execution on developer and training infrastructure.

Affected Products

Weights & Biases wandb Python SDK versions prior to 0.29.0
Machine learning workflows using the File.download API in wandb/apis/public/files.py
Any environment that connects a vulnerable wandb client to an untrusted or compromised W&B backend

Discovery Timeline

2026-09-15 - CVE-2026-91771 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91771

Vulnerability Analysis

The vulnerability resides in the File.download method of the wandb public API, defined in wandb/apis/public/files.py. When a client requests a file associated with a run or artifact, the backend returns metadata that includes the file name. The client joins that name with a user-specified local root directory and writes the response body to disk. Because the returned name is trusted without normalization or containment checks, a backend response containing sequences such as ../../.bashrc or ../../site-packages/<module>.py resolves to paths outside the intended download directory.

Exploitation requires user interaction in the form of running a download against attacker-controlled backend data. The resulting write primitive is high impact because ML developer machines commonly execute shell profiles and import Python modules from predictable locations.

Root Cause

The root cause is missing path validation on server-supplied file names. The pre-patch code path constructs the destination by concatenating a caller-supplied root with the untrusted file name, then opens the target for writing. There is no check that the resolved absolute path remains within the intended root directory, and no rejection of absolute paths or .. components.

Attack Vector

An attacker who controls or compromises a W&B backend, or who can perform a man-in-the-middle attack on an unauthenticated channel, returns crafted file metadata to a victim's wandb client. When the victim invokes File.download, the traversal sequence causes the client to overwrite arbitrary files that the victim's process can write. Overwriting ~/.bashrc, ~/.bash_profile, or files inside a Python site-packages directory yields code execution the next time the affected shell or module is loaded.

python

# Patch excerpt: wandb/apis/public/files.py
 from wandb.apis.public import utils
 from wandb.apis.public.runs import Run
 from wandb.proto.wandb_api_pb2 import ApiRequest, DownloadFileRequest
+from wandb.sdk.lib.paths import validate_fspath
 from wandb.util import POW_2_BYTES, to_human_size

 if TYPE_CHECKING:
# Source: https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6

The fix introduces validate_fspath from wandb.sdk.lib.paths and applies it before writing the downloaded file, rejecting names that escape the intended download root. A related change in wandb/sdk/artifacts/_validators.py tightens path handling for artifact downloads as well.

Detection Methods for CVE-2026-91771

Indicators of Compromise

Unexpected modification timestamps on shell startup files such as ~/.bashrc, ~/.bash_profile, ~/.zshrc, or ~/.profile on hosts that run wandb.
New or modified .py files inside Python site-packages directories that correlate in time with wandb download activity.
Files written outside the directory passed to File.download by user code, especially files whose names contain .. segments in backend logs.

Detection Strategies

Inventory hosts running wandb and flag installs where wandb.__version__ is below 0.29.0.
Instrument endpoint file integrity monitoring to alert on writes by Python processes to shell rc files, cron directories, and site-packages.
Inspect W&B backend or proxy logs for API responses whose name field contains .., absolute paths, or backslashes.

Monitoring Recommendations

Alert when Python processes invoking wandb write outside the workspace or dataset directories declared by the pipeline.
Correlate wandb client network sessions with subsequent file writes to sensitive user profile paths.
Track outbound connections from training nodes to any W&B endpoint that is not the sanctioned SaaS or self-hosted instance.

How to Mitigate CVE-2026-91771

Immediate Actions Required

Upgrade wandb to version 0.29.0 or later on all developer workstations, CI runners, and training nodes.
Audit shell startup files and Python site-packages on hosts that ran vulnerable wandb clients against untrusted backends.
Restrict wandb clients to trusted backends and enforce TLS to prevent response tampering.

Patch Information

The fix is included in WandB Release v0.29.0 and delivered by commit e52558f. Additional context is available in WandB Issue #12592 and the VulnCheck Advisory for WandB.

Workarounds

Avoid calling File.download against untrusted or unverified W&B backends until upgrading is complete.
Run wandb clients under a dedicated low-privilege user without write access to shell startup files or shared Python environments.
Egress-filter wandb traffic so that only the sanctioned backend hostname is reachable from training and developer hosts.

bash

# Upgrade wandb to a fixed version
pip install --upgrade 'wandb>=0.29.0'

# Verify installed version
python -c "import wandb; print(wandb.__version__)"