CVE-2026-42075 Details
Description
Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.
A path traversal vulnerability has been identified in Evolver versions prior to 1.69.3. The issue arises in the skill download (fetch) command, where the --out= flag accepts user-provided paths without proper validation. This flaw enables directory traversal attacks, allowing attackers to write files to arbitrary locations on the filesystem. Exploitation of this vulnerability could overwrite critical system files or create files in sensitive areas, such as the user's home directory or SSH configuration.
Users should update to Evolver version 1.69.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/EvoMap/evolver/releases/tag/v1.69.3 | [email protected] | Release NotesVendor |
| https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EvoMap evolver | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |