Perses: Unvalidated project parameter enables filesystem path traversal
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| perses | perses | before 0.54.0-rc.0 | 0.54.0-rc.0 | Patch available | CNA |
| — | github.com/perses/perses (Go) | before 0.54.0-rc.0 | 0.54.0-rc.0 | Patch available | GHSA-vr5f-w35q-98jp |
- perses Vendorperses Affected before 0.54.0-rc.0 Fixed in 0.54.0-rc.0 Patch available CNA
- github.com/perses/perses (Go) Vendor— Affected before 0.54.0-rc.0 Fixed in 0.54.0-rc.0 Patch available GHSA-vr5f-w35q-98jp
Remediation
- Fix · CNA perses (perses) Fixed in 0.54.0-rc.0
- Fix · GHSA-vr5f-w35q-98jp github.com/perses/perses (Go) Fixed in 0.54.0-rc.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Advanced Cluster Management for Kubernetes 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63445
- 2026-10-03 Alias added: GHSA-vr5f-w35q-98jp
References
More perses vulnerabilities
- TI-2026-45088 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure CVSS 4.0HIGH 8.3
- TI-2026-45226 Perses project query parameter authorization bypass exposes cross-project resources CVSS 4.0HIGH 7.1
Sources
- CVE-2026-63445 · CVE Program
- CVE-2026-63445 · NVD
- FIRST EPSS
- GHSA-vr5f-w35q-98jp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63445 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences