Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based
    dataset builders where the file_name metadata field is not properly validated before being joined to the
    dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to
    read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is
    called. (CVE-2026-66007)

ID	Name	Product	Family	Type	Severity
473748	Chainguard: multiple open-webui packages: security update to 0.11.4-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473748	Chainguard: multiple open-webui packages: security update to 0.11.4-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
471925	SCA: security update for datasets (GHSA-379c-qx7v-6h59)	Tenable Cloud Security	SCA Checks	Local	medium
471925	SCA: security update for datasets (GHSA-379c-qx7v-6h59)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-66007

medium

Tenable Plugins

medium

medium

medium

medium