Evidently UI versions up to 0.7.21 contain a path traversal vulnerability that permits unauthenticated attackers to read arbitrary files from the host system.

This is a path traversal vulnerability (CWE-22) residing in the dataset materialization endpoint. The application fails to sanitize the filename parameter, enabling an unauthenticated attacker to escape the intended workspace directory and access sensitive files on the server.

The ability to read arbitrary files can lead to the exposure of credentials, configuration files, and sensitive environment data. With a CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality of the entire hosting environment.

Immediate Action: Update the Evidently software to the latest patched version provided by the vendor.

Proactive Monitoring: Review system and application logs for path traversal patterns, such as the use of double-dot sequences in file-related API requests.

Compensating Controls: Deploy a WAF to block requests containing directory traversal sequences (e.g., ../) and ensure the application runs with the least-privilege service account.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Due to the sensitive nature of information potentially stored in machine learning workspaces, this update should be applied as soon as possible. Restrict network access to the Evidently UI to trusted internal segments until the patch is successfully deployed.