CVE-2026-42075: Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-04 · updated 2026-10-26
Weakness: CWE-22

Description

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.

Affected products

EvoMap evolver: before 1.69.3

References

https://github.com/EvoMap/evolver/releases/tag/v1.69.3
https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j
https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j

Get alerted when CVE-2026-42075 or the next vulnerability affects your stack