CVE-2026-48129 Details
Description
Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.
A vulnerability in Kestra's task 'inputFiles' prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 allows for arbitrary file creation or overwriting outside the designated task working directory. This issue arises because 'inputFiles' writes rendered file names directly into the task's working directory without proper validation. When untrusted data is forwarded into an 'inputFiles' file name, it can be manipulated using '../' path segments to access the worker filesystem outside the intended directory. The vulnerability is present in versions prior to 1.3.18, 1.2.18, 1.1.18, and 1.0.42.
Users should update to Kestra versions 1.3.19, 1.2.19, 1.1.19, or 1.0.43.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kestra | < 1.3.19 (semver) < 1.2.19 (semver) < 1.1.19 (semver) < 1.0.43 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |