CVE-2026-75111 evidentlyai CVE debrief

Who should care

Defenders responsible for Evidently UI installations, security teams, and IT personnel should be aware of this vulnerability and take necessary actions to prevent potential file reads and dataset materialization abuse.

Why it matters

CVE-2026-75111 is a high-severity vulnerability in Evidently UI that allows unauthenticated attackers to read arbitrary files outside the workspace directory. Defenders should prioritize verifying and patching Evidently UI installations to prevent potential file reads and dataset materialization abuse.

• Potential unauthorized file reads outside the workspace directory
• Possible abuse of dataset materialization endpoint

Technical summary

The Evidently UI dataset materialization endpoint fails to validate the filename parameter, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint. This vulnerability has a CVSS score of 8.7 and is considered high severity. The vulnerability is particularly concerning because it allows attackers to access system files without authentication, potentially leading to unauthorized file reads and dataset materialization abuse.

Defensive priority

Defenders should prioritize verifying and patching Evidently UI installations to prevent potential file reads and dataset materialization abuse.

Recommended defensive actions

• Verify and patch Evidently UI installations to prevent potential file reads and dataset materialization abuse
• Restrict access to the dataset materialization endpoint
• Monitor for suspicious activity on Evidently UI systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The Evidently UI dataset materialization endpoint fails to validate the filename parameter, allowing attackers to supply traversal sequences or absolute paths to access system files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.