CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.

• CWE-22

• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0
• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6343Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3
• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …5.9
• CVE-2026-63449Suricata is a network Intrusion Detection System, Intrusion …3.7
• CVE-2026-6345Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63450Suricata is a network Intrusion Detection System, Intrusion …3.7