VULNERABILITY INTELLIGENCE

CVE-2026-66007

CVSS score6.5 MEDIUM

EPSS probability0.55%

CISA KEVNot currently listed

Published2026-07-24

Last modified2026-10-24

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Weakness classification

disclosure@vulncheck.com: CWE-22

Primary references

disclosure@vulncheck.com — Patch
disclosure@vulncheck.com — Exploit, Issue Tracking, Vendor Advisory
disclosure@vulncheck.com — Issue Tracking, Patch
disclosure@vulncheck.com — Exploit, Patch, Third Party Advisory