CVE-2026-63445 in Perses
Summary
by MITRE • 09/18/2026
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within the Perses open-source observability dashboard and visualization platform represents a critical path traversal flaw that compromises both data confidentiality and logical security boundaries. Prior to version 0.54.0-rc.0, the application's list endpoints utilized for querying resources against a file-system based database failed to properly sanitize user-supplied input before using it as part of a filesystem path construction operation. Specifically, the project query parameter, which is controlled by the requestor, was directly bound into the internal Query structure without any validation or sanitization checks for directory traversal sequences such as dot-dot-slash characters. This lack of input validation allows an attacker to manipulate the intended file system navigation logic, effectively breaking out of the designated project-specific directories where data is securely stored and isolated from other tenants or projects within the same instance.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The operational impact stems from the fact that Perses relies on these project identifiers to determine which subset of YAML and JSON configuration files should be accessed or listed. By injecting directory traversal segments into the request parameters, an authenticated attacker can redirect file read operations outside the intended sandboxed environment. This capability enables the reading of arbitrary files accessible by the user account under which the Perses process executes. In many deployment scenarios, this may include sensitive configuration files, internal service credentials stored in YAML manifests, or other project-specific resources that were not meant to be visible to unauthorized users within different projects.
The security implications extend beyond simple file disclosure, as this vulnerability facilitates a bypass of logical access controls designed to enforce multi-tenancy and resource isolation. By enumerating paths outside the current project boundary, an attacker can discover the existence and structure of other resources across the entire system. This enumeration capability significantly aids in further reconnaissance efforts, allowing the adversary to map out the broader infrastructure managed by Perses and potentially identify additional targets for exploitation. The ability to read arbitrary files also poses a risk if sensitive data such as API keys or database connection strings are inadvertently stored within these configuration files, leading to potential credential theft and subsequent lateral movement within the network environment.
This vulnerability is categorized under MITRE ATT&CK technique T1083: File and Directory Discovery, which describes how adversaries use operating system utilities to search for information on compromised systems. The exploitation requires authentication, meaning that only users with valid credentials can leverage this flaw, but given that Perses often manages critical observability configurations, the compromise of even a single low-privileged account can lead to significant systemic exposure due to the lack of strict path validation in core API endpoints.
To mitigate this risk, organizations running versions prior to 0.54.0-rc.0 must upgrade immediately to the patched version where input sanitization for directory traversal characters has been implemented. In addition to upgrading, administrators should ensure that the Perses process runs under a restricted user account with minimal file system permissions, adhering to the principle of least privilege. This limits the potential damage if an attacker successfully exploits the path traversal flaw by restricting access only to the specific directories required for normal operation. Furthermore, implementing strict input validation on all API endpoints that interact with the file system is essential to prevent similar vulnerabilities in future updates or custom extensions.