CVE-2026-42075

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= flag accepts user-provided paths without validation, enabling directory traversal attacks that can overwrite critical system files or create files in sensitive location. This issue has been patched in version 1.69.3.

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-26)

CWE

CWE-22

Published

2026-05-04

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Packages (OSV)

References

• https://github.com/EvoMap/evolver/releases/tag/v1.69.3
• https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j
• https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j

Check your stackJSON