CVE-2026-63445: Arbitrary File Read and Path Traversal in Perses File-System Database Backend
Vulnerability ID: CVE-2026-63445
CVSS Score: 7.1
Published: 2026-09-18
An arbitrary file read and path traversal vulnerability exists in Perses prior to version 0.54.0-rc.0. When configured with a file-system database backend, the application lacks input validation on the request-controlled project query parameter. An authenticated attacker with low privileges can supply directory traversal sequences to read arbitrary JSON or YAML files on the host file system.
TL;DR
Unvalidated project query parameters in Perses allow authenticated path traversal and arbitrary JSON/YAML file reading when using the file-system database.
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network
- CVSS v4.0 Score: 7.1
- Privileges Required: Low
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- Perses (observability dashboard and visualization project)
-
Perses: < 0.54.0-rc.0 (Fixed in:
0.54.0-rc.0)
Code Analysis
Commit: 75e5471
Fix path traversal vulnerability by validating project query parameters
Mitigation Strategies
- Upgrade Perses to version 0.54.0-rc.0 or later to enforce strict input validation.
- Deploy Web Application Firewall (WAF) rules to detect and block path traversal sequences in query parameters.
- Apply the principle of least privilege to the host process execution environment.
Remediation Steps:
- Identify all Perses deployments running versions prior to 0.54.0-rc.0.
- Back up the local database files located in the storage directory.
- Update the Perses container image or binary to version 0.54.0-rc.0 or a later stable release.
- Verify that requests with traversal parameters return a 400 Bad Request error.
- Ensure the Perses service runs under a non-root system user account.
References
Read the full report for CVE-2026-63445 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)