CVE-2026-63445 Details
Description
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.
A path traversal vulnerability has been identified in Perses versions prior to 0.54.0-rc.0, specifically within the list endpoints when the filesystem database is used. The vulnerability arises because the project query parameter, controlled by the user, is incorporated into the resource Query structure without proper validation against directory traversal characters. This unvalidated input allows an authenticated attacker to traverse directories, access arbitrary YAML or JSON files available to the Perses process, and circumvent project isolation to enumerate other file-backed resources.
Users are advised to upgrade to Perses version 0.54.0-rc.0 or later. For those using an earlier version, avoid the filesystem database in production and switch to an SQL database instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a | [email protected] | Source CodeVendor |
| https://github.com/perses/perses/releases/tag/v0.54.0-rc.0 | [email protected] | Release NotesVendor |
| https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Perses | < 0.54.0-rc.0 (semver) < 0.54.0-beta.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | New CVE Received | [email protected] |
| Sep 18, 2026 | CVE Modified | CISA-ADP |