PT-2026-36853 · Evolve · Evolver

Xeloxa · Published 2026-04-22 · Updated 2026-05-04 · CVE-2026-42075

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evolver versions prior to 1.69.3

Description A path traversal issue exists in the skill download (fetch) command. The --out= flag accepts user-provided paths without proper validation, allowing attackers to write files to arbitrary locations on the filesystem. This can lead to the overwriting of critical system files or the creation of files in sensitive locations.

Recommendations Update to version 1.69.3.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42075

GHSA-R466-RXW4-3J9J

Affected Products

Evolver

References · 7

• 🔥 https://github.com/EvoMap/evolver/security/advisories/GHSA-r466-rxw4-3j9j · Exploit
• https://osv.dev/vulnerability/GHSA-r466-rxw4-3j9j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42075 · Security Note
• https://github.com/EvoMap/evolver · Note
• https://github.com/EvoMap/evolver/releases/tag/v1.69.3 · Note
• https://twitter.com/CVEnew/status/2051361276236853756 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051447172751581404 · Twitter Post