CVE-2026-42075 - Vulnerability Analysis

Overview

Evolver < 1.69.3 contains a path traversal vulnerability caused by lack of validation on the --out= flag in the skill download command, letting attackers write files to arbitrary filesystem locations, exploit requires crafted path input.

Severity & Score

Impact

Attackers can write files to arbitrary locations, potentially overwriting critical system files or creating files in sensitive locations.

Mitigation

Update to version 1.69.3 or later.

References

• https://github.com/EvoMap/evolver/releases/tag/v1.69.3
• https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner