EUVD-2026-52696
GHSA-pcjm-g28j-xmf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no authentication required, trivial URL crafting to exploit; confidentiality impact only with no write access or availability disruption possible per description.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.
AnalysisAI
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrary server-side files by injecting literal ../ path traversal segments into HTTP request URLs targeting the CWD static file handler. The sanitization routine strips only query-string parameters, leaving path-based traversal sequences intact and enabling escape from the configured asset root to retrieve sensitive files such as system credentials and application secrets. A publicly available proof-of-concept exploit exists per VulnCheck and researcher disclosure; combined with a wildcard Access-Control-Allow-Origin header on all responses, the vulnerability also enables cross-origin exfiltration through attacker-controlled web pages without any victim interaction.
Technical ContextAI
The affected software is perspective-dev/perspective, an open-source streaming data visualization and analytics framework (CPE: cpe:2.3:a:perspective-dev:perspective:*:*:*:*:*:*:*:*), with all versions up to and including 5.0.0 confirmed vulnerable per EUVD-2026-52696. The root cause (CWE-22: Path Traversal) resides in Perspective's CWD static file handler, which attempts to sanitize incoming URL paths to prevent directory traversal but only processes query-string components - leaving literal ../ sequences in the URL path untouched. When the handler resolves these unsanitized paths relative to the server's current working directory or configured asset root, an attacker can traverse arbitrarily deep into the filesystem hierarchy. A compounding design flaw is the universal application of an Access-Control-Allow-Origin: * response header, which transforms a server-side file read into a browser-scriptable cross-origin exfiltration primitive, allowing attacker-hosted JavaScript to retrieve and relay the file contents.
RemediationAI
No specific patched release version was identified in any available intelligence source; organizations should monitor the perspective-dev/perspective repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/perspective-path-traversal-via-cwd-static-file-handler for a fix release and upgrade immediately upon availability. As an interim compensating control, restrict network access to Perspective instances to trusted IP ranges via firewall or security group rules, preventing unauthenticated external actors from reaching the static file handler - this eliminates remote exploitation but does not protect against internal threats. If Perspective must remain internet-facing, deploying a reverse proxy such as nginx in front of it to normalize and block URL paths containing ../ sequences provides meaningful protection; however, proxy-level path normalization should be tested for compatibility with legitimate application routing. Additionally, overriding or removing the wildcard Access-Control-Allow-Origin header at the network edge or via a proxy eliminates the cross-origin exfiltration vector and materially reduces browser-based attack scenarios, though this does not prevent direct non-browser exploitation and may break legitimate cross-origin data access features in Perspective client applications.
More in Perspective
View allPerspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field val
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS com
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unrespons
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today