CVE-2026-35492 - Vulnerability Analysis
MediumCVSS: 6.5Last Updated: April 7, 2026
Kedro-Datasets - Path Traversal
Published: April 7, 2026Updated: April 7, 2026PoC AvailableRemote Exploitable
Overview
Kedro-Datasets < 9.3.0 contains a path traversal caused by unvalidated concatenation of partition IDs with dataset base path in PartitionedDataset, letting attackers write files outside intended directories, exploit requires crafted partition ID input.
Severity & Score
Severity: Medium
CVSS Score: 6.5
Impact
Attackers can overwrite arbitrary files on the filesystem, potentially leading to data loss or system compromise.
Mitigation
Upgrade to version 9.3.0 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-35492
- Severity
- Medium
- CVSS Score
- 6.5
- Type
- path_traversal
- Status
- new
CWE
- CWE-22
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N