Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67200 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.6 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://christbowel.com/blog/perspective-5-0-0-five-cves/	[email protected]	BundleTechnical Analysis
https://www.vulncheck.com/advisories/perspective-path-traversal-via-cwd-static-file-handler	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
Perspective	<= 5.0.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Workaround:low effort Do not expose the cwd_static_file_handler to untrusted networks. Workaround:low effort Implement path resolution with containment checks to prevent traversal. For example: const resolved = path.resolve(root, "." + url); if (!resolved.startsWith(path.resolve(root) + path.sep)) { response.writeHead(403); response.end(); return; }
@perspective-dev/client	<= 5.0.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation No remediation found in references.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 5, 2026	CVE Modified	CISA-ADP
Aug 4, 2026	New CVE Received	[email protected]