CVE-2026-91771
Weights & Biases wandb before 0.29.0 Path Traversal via File Download
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
| CWE | CWE-22 |
| Vendor | wandb |
| Product | wandb |
| Published | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for wandb wandb
Be the first to know when new high vulnerabilities affecting wandb wandb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
wandb / wandb
0 < 0.29.0
References
github.com: https://github.com/wandb/wandb/issues/12592 github.com: https://github.com/wandb/wandb/commit/e52558f3a6a94ea816af74969a13a35e5904cad6 github.com: https://github.com/wandb/wandb/releases/tag/v0.29.0 github.com: https://github.com/wandb/wandb/blob/v0.27.2/wandb/apis/public/files.py#L319-L347 github.com: https://github.com/wandb/wandb vulncheck.com: https://www.vulncheck.com/advisories/weights-biases-wandb-before-0.29.0-path-traversal-via-file-download
Credits
🔍 George Chen