CVE-2026-42075

High

Published: 04/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Evolver is an AI engine that prior to version 1.69.3 had a path traversal vulnerability in the skill download command. Attackers could write files to arbitrary locations on the filesystem, posing a risk of overwriting critical system files.

Risk Assessment

This vulnerability could lead to serious security breaches, including overwriting important system files or placing malicious software in sensitive locations.

Recommendation

It is recommended to upgrade to version 1.69.3 or later to mitigate this vulnerability and implement additional path validation mechanisms in the application.

Other vulnerabilities in Evolver

CVE-2026-42076Critical
Evolver is an AI self-evolving engine that prior to version 1.69.3 had a command injection vulnerability in the _extractLLM() function. This allows attackers to execute arbitrary shell commands on the server due to improper handling of parameters.

Original NVD description (English source)

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.