CVE-2026-42075

8.1 Élevée

Publiée le 04/05/2026 à 19:16 · Modifiée le 17/06/2026 à 12:47 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.

Traduire en français

Produits concernés

EvoMap evolver

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-22

Références

https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j
https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories