Executive Summary

CVE-2026-35492 is a path traversal vulnerability in the PartitionedDataset component of the kedro-datasets Python package versions prior to 9.3.0.

The issue occurs because partition IDs are concatenated directly with the dataset base path without proper validation or normalization.

An attacker can supply malicious partition IDs containing path traversal sequences like "..", which allows files to be written outside the intended dataset directory.

This can lead to arbitrary file overwrite on the filesystem, affecting all storage backends supported by PartitionedDataset, including local filesystems, Amazon S3, and Google Cloud Storage.

The vulnerability was fixed in kedro-datasets version 9.3.0 by normalizing paths and validating that resolved paths remain within the dataset directory, raising an error if they do not.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker or malicious input to overwrite arbitrary files on your filesystem outside the intended dataset directory.

Such unauthorized file writes can compromise the integrity of your system or data by replacing or corrupting important files.

The vulnerability has a CVSS v3.1 base score of 6.5, indicating moderate severity, with a high impact on integrity but no impact on confidentiality or availability.

Because the attack vector is network-based and requires low privileges with no user interaction, it can be exploited relatively easily if the vulnerable component is exposed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal via malicious partition IDs containing sequences like ".." that cause files to be written outside the intended dataset directory.

To detect exploitation attempts or presence of this vulnerability, you should check for partition IDs or inputs containing path traversal components such as "..".

Since the issue is related to file writes outside the expected directory, monitoring filesystem activity for unexpected file creations or modifications outside the dataset base path may help detect exploitation.

There are no specific commands provided in the resources, but you can use commands like the following to search for suspicious partition IDs or files:

• On Linux systems, search for files created or modified outside the expected dataset directory using: find / -type f -newermt "YYYY-MM-DD"
• Search for partition IDs containing ".." in your dataset configuration or logs using: grep -r '\.\.' /path/to/kedro/configs
• Monitor application logs for errors or DatasetError exceptions indicating path traversal attempts.

If you cannot upgrade immediately, manually validate partition IDs to ensure they do not contain ".." or other path traversal components before they are used.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade kedro-datasets to version 9.3.0 or later, where the vulnerability is fixed by normalizing and validating partition paths.

If upgrading is not immediately possible, you should manually validate all partition IDs to ensure they do not contain path traversal sequences such as ".." before passing them to PartitionedDataset.

Additionally, monitor your filesystem and application logs for suspicious activity or errors related to path traversal attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Kedro-Datasets' PartitionedDataset component allows arbitrary file overwrite outside the intended dataset directory due to path traversal. This could lead to unauthorized modification of files on the filesystem.

Such unauthorized file writes could potentially impact data integrity and security controls required by common standards and regulations like GDPR and HIPAA, which mandate protection against unauthorized data alteration and ensuring data integrity.

However, the provided information does not explicitly discuss or analyze the direct impact of this vulnerability on compliance with these standards.

Useful 0 Not Useful 0