The weakness type is a Path Traversal flaw, identified as CWE-22. Evidently offers a web interface for dataset materialization but it does not properly sanitise the filename parameter. The flaw allows an attacker to inject path traversal characters or absolute paths, causing the server to read and expose arbitrary files that lie outside the intended workspace directory. The retrieved files are then returned through the download endpoint, giving the attacker access to potentially sensitive system or configuration data.

The vulnerability resides in the Evidently open‑source library (evidentlyai:evidently). No specific version range is listed, so any deployment using the affected dataset materialization endpoint that is not updated to a patched release is at risk.

The flaw receives a CVSS score of 8.7, indicating high severity. The EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can exploit the issue without authentication by sending a crafted request to the dataset materialization endpoint with a malicious filename; the server will read the requested file and serve it back. The attack is straightforward and does not require privileged access, making it highly actionable for unauthenticated threat actors.