highCVE-2026-63445Sep 18, 2026

CVE-2026-63445: Perses Filesystem Path Traversal via Unvalidated Project Parameter

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Perses versions before 0.54.0-rc.0 let an attacker read arbitrary YAML/JSON files off the server by supplying directory-traversal sequences in the project query parameter on any list endpoint.

Packagegithub.com/perses/perses
Ecosystemgo
Affected< 0.54.0-rc.0
Fixed in0.54.0-rc.0

The problem

When Perses is configured to use the file system database, every list endpoint (dashboards, datasources, variables, etc.) binds the incoming project query string directly into the resource Query struct. That struct is passed straight to the file-system layer to construct the directory path used for reading resources.

The server-side input validation (validation/Flatten) only runs during Create and Update operations, never during list queries. There is no separate sanitization step for query parameters, so traversal sequences like ../ are accepted verbatim and resolved against the data directory on disk.

An attacker can read any YAML or JSON file the process has permission to open, bypassing all project-scoping security controls.

Proof of concept

A working proof-of-concept for CVE-2026-63445 in github.com/perses/perses, with the exact payload below.

http
GET /api/v1/dashboards?project=../projects HTTP/1.1
Host: localhost:8080

The advisory provides this exact URL as the proof-of-concept: requesting /api/v1/dashboards?project=../projects returns the projects list instead of nothing, because the server resolves the database path as <data_dir>/../projects/. The ../ segment walks out of the intended project directory and into a sibling directory.

The patch (commit 75e5471040cc) adds traversal-character validation to the query-parameter binding path, mirroring the validation that already existed for request bodies. CWE-22 applies directly: the pathname is constructed from user-controlled input without checking that the resolved path stays within the allowed root.

The fix

Upgrade to Perses 0.54.0-rc.0 or later (stable: v0.54.0). If you cannot upgrade immediately, avoid running the file-system database in production and switch to the SQL database backend instead.

Reporter not attributed.

References: [1][2][3][4]

Related research