EUVD-2026-83268
GHSA-vr5f-w35q-98jp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated (PR:L) network low-complexity arbitrary file read gives C:H with no integrity or availability impact; scope unchanged as the leak stays within the Perses process's own file access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.
AnalysisAI
Authenticated path traversal in Perses before 0.54.0-rc.0 allows any user holding a valid Perses account to read arbitrary YAML and JSON files accessible to the Perses process by injecting directory-traversal segments (e.g. ../) into the project query parameter of list endpoints such as /api/v1/dashboards. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Perses instance is deployed with the FILE-SYSTEM database backend (not the SQL backend - the SQL configuration is not vulnerable and is the vendor's stated workaround), and that the attacker holds a valid authenticated Perses account (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional data-disclosure issue, not a headline-grade emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Perses 0.54.0-rc.0 (or later) - the fix commit 75e5471040ccb5674ea8d25c2aa16c80ccb70b2a adds common.ValidateID() on the project query parameter in internal/api/toolbox/list.go, rejecting traversal sequences with an HTTP 400 before any path lookup; the release is published at https://github.com/perses/perses/releases/tag/v0.54.0-rc.0 and details are in advisory GHSA-vr5f-w35q-98jp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Perses deployments and determine which use the file-system database backend; for those, either migrate to the SQL backend (vendor-stated workaround) or upgrade to Perses 0.54.0-rc.0 (vendor-released patch). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Authenticated users holding only viewer rights on a single project can read the dashboards, datasources, and variables o
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today