{"id":"CVE-2026-63445","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-63445","summary":"Perses's unvalidated project parameter enables filesystem path traversal","details":"### Impact\nWhen Perses is using the file system database, on  the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). \n\nThe path is then used to retrieve files in the database directly.\n\nAttacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to get access to other resources contained in the file database.\n\nFor example `https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of the project while it must not return anything.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\nAvoid using the file system database in production. Use SQL database instead.","published":"2026-09-18T17:40:03Z","modified":"2026-09-18T17:45:05.843505709Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/perses/perses","fixedVersion":"0.54.0-rc.0"}],"fix":{"url":"https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a","label":"perses/perses@75e5471"},"references":[{"type":"WEB","url":"https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp"},{"type":"WEB","url":"https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a"},{"type":"PACKAGE","url":"https://github.com/perses/perses"},{"type":"WEB","url":"https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T17:45:05.843505709Z"}}