Path Traversal Vulnerability in Weights & Biases Wandb

CVE-2026-91771

What is CVE-2026-91771?

The Weights & Biases wandb prior to version 0.29.0 contains a path traversal vulnerability in its File.download function. This vulnerability arises from the failure to validate the file names returned from server responses, which allows an attacker controlling the backend to exploit the mechanism by providing malicious file names that include directory traversal sequences. Such exploitation can lead to unauthorized file writing outside the designated download directory, potentially compromising system integrity through code execution after altering shell startup files or Python import paths.

References