Directory Traversal

Overview wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Directory Traversal in the File.download method of wandb/apis/public/files.py, which builds the destination with os.path.joinroot, self.name and never checks...

CVE-2026-91771

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2026-91771

A flaw was found in Weights & Biases wandb. This vulnerability allows attackers controlling the backend to supply file names with directory traversal sequences during file download operations. This can lead to writing files outside the intended download directory, potentially enabling arbitrary...

CVE-2026-91771

Weights & Biases wandb (Python SDK) before 0.29.0 is affected by a path traversal vulnerability in the File.download function. The function fails to validate file names received from server responses, allowing an attacker who controls the W&B backend to supply file names containing directory trav...

CVE-2026-91771 Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2026-91771 Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2026-91771 Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

PT-2026-91830

Name of the Vulnerable Software and Affected Versions Weights & Biases wandb versions prior to 0.29.0 Description Insufficient validation of file names received from server responses in the File.download function allows path traversal attacks. An attacker controlling the backend can use directory...

CVE-2026-91771: Improper Limitation of a Pathname to a Restricted Directory

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2026-15605

A flaw was found in wandb. A remote attacker could exploit the use of a weak hash algorithm during artifact integrity validation in the ArtifactManifestEntry.download function. This could potentially lead to a low impact on confidentiality, allowing for limited information disclosure...

aap-core (0.2.0), aap-dspy (>=0.1.1.dev1, <=0.2.0) +1680 more potentially affected by CVE-2026-15605 via wandb (>=0.8.36, <=0.29.0)

wandb PYPI version =0.8.36, =0.1.1.dev1, =0.1.1.dev1, =0.1.1.dev1, =0.1.1.dev1, =0.2.0a0, =1.2.0, =0.1.0, =0.0.1, =0.3.3, =0.0.1, =0.1.0, =0.0.9, =0.1.2 and more Source cves: CVE-2026-15605 Source advisory: SNYK:PYTHON-WANDB-17966703...

Use of Weak Hash

Overview wandb is an A CLI and library for interacting with the Weights and Biases API. Affected versions of this package are vulnerable to Use of Weak Hash through ArtifactManifestEntry.download in wandb/sdk/artifacts/artifactmanifestentry.py and related artifact verification paths. An attacker...

CVE-2026-15605

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

CVE-2026-15605 wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

CVE-2026-15605

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

CVE-2026-15605

The vulnerability CVE-2026-15605 affects wandb 0.25.2.dev1, specifically the ArtifactManifestEntry.download path in wandb/sdk/lib/hashutil.py under Artifact Integrity Validation. The issue is described as the use of a weak hash due to manipulating the ArtifactManifestEntry.download, with the atta...

CVE-2026-15605 wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

CVE-2026-15605: Use of Weak Hash

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

PT-2026-57914

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

CVE-2026-4995

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...