Directory traversal that could allow attackers to read arbitrary files

Information

• Advisory ID: DSA-2026-025

• CVSS Base Score: 8.8

• CVSS String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Severity: High

• CWE classification: CWE-22

Summary

In Dataiku before 14.7.7, and in Dataiku between 15.0.0 inclusive and 15.2.2 exclusive, a directory traversal vulnerability could allow authenticated attackers to read arbitrary files, including credential files. The exposed credentials could allow attackers to compromise the confidentiality, integrity and availability of DSS.

Affected Products

• Dataiku before 14.7.7

• Dataiku between 15.0.0 inclusive and 15.2.2 exclusive

Fix

Dataiku 14.7.7 and 15.2.2 have been made available to customers to remediate this issue.