Perspective CVE-2026-67200

No special conditions - remote unauthenticated exploitation against default configurations of Perspective 5.0.0. The CVSS 4.0 vector confirms no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L/AT:N), meaning the vulnerability is exploitable against any network-reachable Perspective 5.0.0 instance without prerequisite access. The vulnerable component is the CWD static file handler, which is part of Perspective's core serving capability and active by default when Perspective serves assets. The wildcard Access-Control-Allow-Origin header is applied universally to all responses, enabling a secondary browser-based cross-origin exploitation path that likewise requires no victim interaction beyond loading an attacker-controlled page. Exploitation is bounded to confidentiality impact only (VI:N, VA:N): attackers can read files accessible to the server process's OS-level permissions but cannot write data or cause a denial of service. Files protected by OS permissions outside the server process's reach are not accessible.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) accurately reflects the attack surface: unauthenticated, low-complexity, network-accessible exploitation with high confidentiality impact. No EPSS score was included in source intelligence, so quantified exploitation probability cannot be stated. The vulnerability is not listed in the CISA KEV catalog at time of analysis, meaning confirmed active widespread exploitation has not been reported to U.S. government intelligence - however, this absence does not preclude targeted exploitation. Critically, a publicly available proof-of-concept exists (documented at christbowel.com alongside four other CVEs in the same disclosure), which materially lowers the practical exploitation bar below what AC:L alone implies. For organizations running Perspective as an internet-facing service, this is a genuine priority - the combination of zero authentication, trivial URL crafting, a working POC, and the CORS amplifier makes immediate remediation warranted. The narrow deployment footprint of Perspective (a specialized analytics framework rather than ubiquitous infrastructure software) limits aggregate exposure relative to the technical severity.

A publicly available proof-of-concept exploit is documented in the christbowel.com researcher disclosure. An unauthenticated remote attacker sends an HTTP GET request to an internet-facing Perspective server with a crafted URL such as /assets/../../etc/shadow or /assets/../../app/.env, bypassing the query-string-only sanitization to traverse the filesystem and retrieve sensitive credentials or secrets in the HTTP response. Because Perspective sets Access-Control-Allow-Origin: * on all responses, an attacker can also embed a fetch() call in a malicious webpage to exfiltrate the file contents cross-origin from any victim browser that loads the page, requiring no direct server access.