https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 21:59:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-111170 <p>kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib&#39;s join discards the base path, attackers can create or overwrite files anywhere the process can write.</p> <p>kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib&#39;s join discards the base path, attackers can create or overwrite files anywhere the process can write.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-111170 https://vulnerability.circl.lu/vuln/ghsa-7vr2-8p3f-2p48 <p>kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib&#39;s join discards the base path, attackers can create or overwrite files anywhere the process can write.</p> <p>kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib&#39;s join discards the base path, attackers can create or overwrite files anywhere the process can write.</p> https://vulnerability.circl.lu/vuln/ghsa-7vr2-8p3f-2p48