CVE-2026-48544 Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()
Unauthenticated attackers can read arbitrary files outside the intended directory via path traversal in Taipy's resource loading mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48544?
CVE-2026-48544 is a high-severity path traversal vulnerability in Avaiga taipy, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-48544?
3 open source packages ship an affected version, including taipy.
| Package | Affected | Fixed in |
|---|---|---|
taipy PyPI | All versions to 4.1.1 | None |
taipy PyPI | All versions to 4.1.1 | None |
taipy PyPI | All versions to 4.1.1 | None |
How do I fix CVE-2026-48544?
No fix has been published for CVE-2026-48544 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48544 exists.
Sources
Also known as GHSA-28gh-q3gw-pvx8, PYSEC-2026-3081.