CVE-2026-111170 kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name
Attackers can write or overwrite arbitrary files outside the intended directory by supplying absolute plot names in MatplotlibDataset.save().
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-111170?
CVE-2026-111170 is a high-severity path traversal vulnerability in kedro-org kedro-datasets, published on 15 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
Weakness: CWE-22
Which versions are affected by CVE-2026-111170?
How do I fix CVE-2026-111170?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-111170 being exploited?
There is no known exploitation of CVE-2026-111170 in the wild and no public exploit code.
Sources
Also known as GHSA-7vr2-8p3f-2p48.