CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal
An authenticated attacker can exploit unvalidated project parameters in file-system database mode to read arbitrary files and bypass project isolation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63445?
CVE-2026-63445 is a high-severity path traversal vulnerability in perses, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-63445?
3 open source packages ship an affected version, including github.com/perses/perses.
| Package | Affected | Fixed in |
|---|---|---|
github.com/perses/perses Go | All versions | 0.54.0-rc.0 |
github.com/perses/perses Go | All versions | 0.54.0-rc.0 |
github.com/perses/perses Go | All versions | 0.54.0-rc.0 |
How do I fix CVE-2026-63445?
Upgrade github.com/perses/perses to 0.54.0-rc.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-63445 being exploited?
There is no known exploitation of CVE-2026-63445 in the wild and no public exploit code.
Sources
Also known as GHSA-vr5f-w35q-98jp, GO-2026-6528.