CVE-2026-63445: Perses Path Traversal Vulnerability

CVE-2026-63445 Overview

CVE-2026-63445 is a directory traversal vulnerability [CWE-22] in Perses, an open-source dashboard and visualization project for observability data. The flaw affects list endpoints backed by the file-system database in versions prior to 0.54.0-rc.0. The endpoints bind the request-controlled project query parameter into the resource Query structure without validating it for traversal sequences. An authenticated attacker can supply path segments such as ../ to escape the intended project directory and read arbitrary YAML or JSON files accessible to the Perses process. This breaks project isolation and enables enumeration of file-backed resources across tenants.

Critical Impact
Authenticated users can traverse outside their project boundary to read arbitrary YAML or JSON files readable by the Perses process, bypassing multi-project isolation controls.

Affected Products

Perses observability platform prior to 0.54.0-rc.0
Deployments configured with the file-system database backend
Multi-project Perses instances relying on project-level isolation

Discovery Timeline

2026-09-18 - CVE-2026-63445 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63445

Vulnerability Analysis

Perses exposes list endpoints that accept a project query parameter to scope resource enumeration. When the file-system database backend is enabled, the value of this parameter is bound directly into the internal resource Query structure. The bound value is then concatenated into filesystem paths used to select the directory from which resources are read.

Because the input is not validated against directory traversal characters, an attacker who has authenticated to the API can inject ../ segments in the project parameter. The database layer resolves the composed path outside the intended project root and returns the contents of files it locates there. Any YAML or JSON file readable by the Perses service account becomes accessible through the list response, defeating the project isolation model that separates dashboards, datasources, and variables between tenants.

Root Cause

The root cause is missing input sanitization on the project query parameter before it is used as a path component in the file-system database driver. There is no allowlist check, canonicalization step, or rejection of .. and separator characters between the HTTP handler and the storage lookup.

Attack Vector

Exploitation requires network access to the Perses API and valid authenticated credentials with permission to list resources. The attacker sends a list request with a crafted project value containing traversal segments pointing at directories outside the configured project root. The vulnerable resource Query is constructed and passed to the file-system backend, which reads and returns file contents from the traversed location.

The upstream fix landed in commit 75e5471040ccb5674ea8d25c2aa16c80ccb70b2a and is included in release v0.54.0-rc.0. See the Perses GHSA-vr5f-w35q-98jp advisory for the maintainer analysis.

// Patch import addition from internal/api/toolbox/list.go
 	"github.com/perses/perses/pkg/model/api"
 	modelV1 "github.com/perses/perses/pkg/model/api/v1"
 	"github.com/perses/perses/pkg/model/api/v1/role"
+	"github.com/perses/spec/go/common"
 	"github.com/tidwall/gjson"
 )
// Source: https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a

The patch introduces the common package into the list toolbox, which the fix uses to validate the project identifier before it reaches the file-system backend.

Detection Methods for CVE-2026-63445

Indicators of Compromise

HTTP requests to Perses list endpoints containing .., %2e%2e, or encoded separators in the project query parameter.
API list responses that return resources whose names or metadata do not match the authenticated user's assigned projects.
Perses process file reads targeting paths outside the configured file-system database root directory.

Detection Strategies

Inspect access logs for list endpoint URIs where the project parameter contains traversal sequences or unexpected characters.
Correlate authenticated user identity with the projects returned in list responses to detect cross-project data access.
Enable filesystem auditing on the directory that holds the Perses file-system database and alert on reads originating outside the expected project subtrees.

Monitoring Recommendations

Forward Perses API access logs and host-level file audit events to a central analytics platform for retention and correlation.
Baseline normal project parameter values per user or API token and alert on deviations.
Track the version banner or health endpoint output of Perses instances to identify deployments still running versions prior to 0.54.0-rc.0.

How to Mitigate CVE-2026-63445

Immediate Actions Required

Upgrade all Perses deployments to version 0.54.0-rc.0 or later, which contains the validation fix.
Rotate any secrets, tokens, or credentials that may have been stored in YAML or JSON files readable by the Perses process.
Audit authenticated user activity for suspicious project parameter values since the deployment was first exposed.

Patch Information

The fix is delivered in commit 75e5471040ccb5674ea8d25c2aa16c80ccb70b2a and shipped in Perses release v0.54.0-rc.0. Refer to the GitHub Security Advisory GHSA-vr5f-w35q-98jp for the vendor description and affected version range.

Workarounds

Restrict API access with network controls or an authenticating reverse proxy that rejects project parameter values containing .. or path separators.
Run the Perses process under a dedicated unprivileged account whose filesystem access is limited to the database root directory.
Where possible, migrate off the file-system database backend to a database backend that is not affected by path traversal.

bash

# Example reverse proxy rule to reject traversal in the project parameter (NGINX)
if ($arg_project ~* "(\.\./|\.\.\\|%2e%2e)") {
    return 400;
}