CVE-2026-42075 affects Evolver, a GEP-powered self-evolving engine for AI agents. The vulnerability exists in versions prior to 1.69.3 and involves a path traversal flaw in the skill download (fetch) command. The --out= flag accepts user-provided paths without proper validation, allowing attackers to perform directory traversal attacks. This enables writing files to arbitrary filesystem locations, potentially overwriting critical system files or creating files in sensitive directories. The vulnerability has been patched in version 1.69.3.