## Summary
Weights & Biases (wandb) versions before 0.29.0 fail to validate file names returned by the server during File.download, enabling path traversal. If an attacker can control the backend responses, they may write files outside the intended download directory, potentially leading to code execution by modifying shell startup files or Python import paths.
## Technical Details
- Root issue: File.download does not validate the server-supplied file name before using it as part of the local filesystem path.
- Vulnerability class: CWE-22 (Path Traversal).
- Attack prerequisites (per NVD): attacker can control the backend; exploitation is network-based.
- Security fix direction (from W&B commit notes): introduce stricter validation to reject relative path traversal when downloading artifacts via artifact.files() and artifact.checkout().
- The referenced change mentions adding validation helpers such as validate_artifact_root_name and tests for traversal patterns (e.g., ../../evil:v0, nested/../evil:v0, a:../evil, a:v0/../../evil).
## Affected
- wandb before 0.29.0.
## Impact
- High risk: path traversal can write files outside the intended directory.
- Potential outcomes include code execution by altering shell startup files or Python import paths.
- CVSS vector indicates AV:N/AC:L/PR:N/UI:R and high impact on confidentiality/integrity/availability.
## Mitigation
1. Upgrade wandb to 0.29.0 or later to ensure server-returned file names are properly validated during File.download.
2. If you cannot upgrade immediately, avoid scenarios where you can be influenced by untrusted backend responses (since the issue assumes backend control).
3. Review usage of artifact download flows such as artifact.files() and artifact.checkout() and ensure you are on a version that includes the added path/root name validation (e.g., validate_artifact_root_name).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-22