CVE-2026-48544 Details

A path traversal vulnerability has been identified in Taipy version 4.1.1, specifically within the ElementLibrary.get_resource() method. This vulnerability allows unauthenticated attackers to escape the designated module directory by taking advantage of an inadequate path containment check. The flaw arises from using str.startswith() for comparison without a trailing path separator, enabling attackers to craft GET requests that include path traversal segments. These requests can target a sibling directory on the disk that matches the prefix, bypassing the directory containment check. The issue is exacerbated by Flask's path converter and Werkzeug's WSGI layer, which preserve the traversal segments, allowing unauthorized access to files outside the intended library directory.

Users can update to Taipy version 4.1.2 or later, where this vulnerability has been fixed.