CVE-2026-91771 in wandb
Summary
by MITRE • 09/15/2026
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Weights & Biases versions prior to 0.29.0 represents a critical security flaw within the File.download function, specifically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This issue stems from an insufficient validation mechanism when processing file names received directly from server responses. In secure software architecture, any data originating from external sources, particularly filenames provided by remote servers during download operations, must be rigorously sanitized and validated against expected patterns before being used in filesystem operations. The absence of such validation allows malicious actors who control or compromise the backend infrastructure to inject directory traversal sequences, typically represented as dot-dot-slash (../) characters, into the filename metadata.
When a user initiates a download through the affected version of Weights & Biases, the application accepts the server-provided filename and uses it directly in file system write operations without verifying that the resulting path remains within the designated local directory structure. This lack of boundary enforcement enables an attacker to manipulate the destination path by appending traversal sequences. Consequently, instead of saving a file into the intended working or download folder, the operation writes data to arbitrary locations on the host operating system's filesystem. The severity of this flaw is amplified because it does not require direct interaction with the client-side application logic beyond initiating a standard download request; rather, it relies entirely on the trust placed in the backend server's response integrity.
The operational impact of this vulnerability extends far beyond simple unauthorized file placement. By controlling where files are written, an attacker can target sensitive system configuration files or user-specific environment scripts. For instance, writing malicious content to shell startup files such as .bashrc, .zshrc, or profile scripts ensures that arbitrary commands execute whenever a new terminal session is opened by the victim. Similarly, targeting Python import paths allows for code injection during script execution, potentially leading to remote code execution with the privileges of the user running the Weights & Biases client. This capability effectively transforms a data storage error into a full system compromise vector, as it bypasses standard sandboxing expectations associated with application-specific directories.
From an offensive security perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically when used for persistence via startup scripts or lateral movement through modified environment variables. It also reflects aspects of T1048: Exfiltration Over Alternative Protocol if the attacker uses the write capability to stage exfiltrated data in hidden locations before retrieval. The root cause is a classic example of insecure direct object reference combined with path traversal, highlighting the necessity for strict allow-listing or canonicalization of file paths prior to filesystem interaction.
Mitigation strategies must focus on immediate patching and defensive coding practices. Users running versions earlier than 0.29.0 should upgrade immediately to the latest stable release where this validation logic has been corrected. For environments unable to update instantly, network-level controls such as web application firewalls can be configured to inspect outbound requests for suspicious filename patterns containing traversal sequences, although this is a less reliable defense than fixing the code itself. Developers implementing similar download functionalities should ensure that all filenames are canonicalized and verified against a whitelist of allowed characters or prefixes before being passed to operating system file APIs. Additionally, employing chroot jails or containerization with strict volume mount restrictions can limit the blast radius if such vulnerabilities exist in other components of the stack.