What is CVE-2026-66007?
CVE-2026-66007 is a path traversal vulnerability in the Datasets library up to version 5.0.0, where the file_name metadata field in folder-based dataset builders is not properly validated before being joined to the dataset directory. This allows attackers to supply crafted file_name values with directory traversal sequences to access unauthorized directories. Users are advised to immediately apply the fix provided in commit f989ef9.
Azərbaycanca: CVE-2026-66007, Datasets kitabxanasının 5.0.0 versiyasına qədər olan versiyalarında mövcud olan path traversal zəifliyidir. Bu zəiflik, folder-based dataset builder-lərdə file_name metadata sahəsinin düzgün yoxlanılmaması səbəbindən, uzaqdan hücumçulara fayl yolunu manipulyasiya edərək icazəsiz qovluqlara çıxış imkanı verir. İstifadəçilərə dərhal commit f989ef9 ilə təmin edilmiş düzəlişi tətbiq etmələri tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of the Datasets library are affected by the CVE-2026-66007 path traversal vulnerability?
This vulnerability affects all versions of the Datasets library up to version 5.0.0.
How can the fix for CVE-2026-66007 be applied?
Users are advised to immediately apply the fix provided in commit f989ef9.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.