EUVD-2026-12635
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Tags
Description
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Analysis
Unauthenticated attackers can read arbitrary files on systems running Ray versions before 2.8.1 by exploiting a path traversal flaw in the Dashboard's static file handler on port 8265. The vulnerability stems from insufficient input validation that allows directory traversal sequences to bypass access controls, and public exploit code is available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all Ray instances running versions prior to 2.8.1 and document their network exposure; restrict network access to port 8265 to trusted internal networks only via firewall rules. Within 7 days: Implement WAF rules to block path traversal patterns (../, ..\ encodings) targeting the Ray Dashboard; monitor access logs for exploitation attempts. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today