CVE-2026-48129

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.

• CWE-22

• https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2
• https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2

Published

Jun 19, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48122Ruby LSP is an implementation of the language server protoco…5.4
• CVE-2026-48124Cursor is a code editor built for programming with AI. In ve…8.5
• CVE-2026-48125UAParser.js is a JavaScript library to detect browsers, oper…5.3
• CVE-2026-48126Algernon is a small self-contained pure-Go web server. Prior…8.2
• CVE-2026-48127Frappe is a full-stack web application framework. Prior to 1…5.3
• CVE-2026-48128Budibase is an open-source low-code platform. Prior to 3.39.…5.1
• CVE-2026-48131The VPN service may mishandle an unexpected IKE fragment val…8.1
• CVE-2026-48132The Security Gateway does not correctly validate a length va…8.1
• CVE-2026-48133When the Identity Awareness blade is enabled with Browser-Ba…7.5
• CVE-2026-48134When the DLP is active, the UserCheck Web Portal contains an…5.6
• CVE-2026-48135A Check Point HTTP-based service can incorrectly handle malf…5.3
• CVE-2026-48136When Compliance is enabled on Check Point Multi-Domain Manag…4.1