EvoMap evolver versions before 1.69.3 contain a path traversal vulnerability in the skill download command. The vulnerability arises because the --out= flag does not properly validate user input, enabling directory traversal attacks. This allows an attacker with limited privileges to write files outside the intended directory, potentially overwriting important system files or creating files in sensitive locations. The vulnerability is tracked as CVE-2026-42075 and has a CVSS 3.1 base score of 8.1, indicating high severity. The issue has been fixed in version 1.69.3.

Exploitation of this vulnerability can lead to unauthorized file writes to arbitrary locations on the filesystem. This may result in overwriting critical system files or placing malicious files in sensitive directories, potentially impacting system integrity and availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported at this time.

Upgrade EvoMap evolver to version 1.69.3 or later, where this path traversal vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory. Patch status is not explicitly confirmed by a vendor advisory link, but the description states the issue is fixed in version 1.69.3.