{"id":"CVE-2026-63445","aliases":["GHSA-vr5f-w35q-98jp","GO-2026-6528"],"url":"https://o3.security/vulnerability/CVE-2026-63445","summary":"Perses: Unvalidated project parameter enables filesystem path traversal","details":"### Impact\nWhen Perses is using the file system database, on  the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). \n\nThe path is then used to retrieve files in the database directly.\n\nAttacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to get access to other resources contained in the file database.\n\nFor example `https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of the project while it must not return anything.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\nAvoid using the file system database in production. Use SQL database instead.","published":"2026-09-18T17:38:02.870Z","modified":"2026-10-28T02:30:42.962751702Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/perses/perses","fixedVersion":"0.54.0-rc.0"}],"fix":{"url":"https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a","label":"perses/perses@75e5471"},"references":[{"type":"WEB","url":"https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63445.json"},{"type":"ADVISORY","url":"https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63445"},{"type":"FIX","url":"https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a"},{"type":"PACKAGE","url":"https://github.com/perses/perses"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:42.962751702Z"}}