CVE-2026-67200: Perspective Path Traversal Vulnerability

CVE-2026-67200 Overview

CVE-2026-67200 is a path traversal vulnerability in Perspective 5.0.0 that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. The flaw resides in the static file handler, which applies insufficient sanitization to HTTP request URL paths. Attackers include literal ../ segments in requests to escape the configured asset root directory. Successful exploitation retrieves sensitive files such as system credentials and application secrets. A wildcard Access-Control-Allow-Origin: * header set on all responses exposes retrieved content cross-origin, expanding the impact to browser-based attacks. The weakness is classified under CWE-22.

Critical Impact
Unauthenticated remote attackers can read arbitrary files, including credentials and secrets, from any host running Perspective 5.0.0.

Affected Products

Perspective 5.0.0

Discovery Timeline

2026-08-04 - CVE-2026-67200 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67200

Vulnerability Analysis

The vulnerability exists in the current-working-directory static file handler in Perspective 5.0.0. The handler attempts to normalize incoming URL paths by stripping query strings before resolving the requested asset. This sanitization step does not remove or reject literal ../ traversal sequences embedded in the path component. As a result, an attacker can construct a URL that traverses upward from the configured asset root and resolves to files elsewhere on the filesystem. The server then reads and returns the target file in the HTTP response body.

Because the server sets Access-Control-Allow-Origin: * on every response, retrieved content is readable by any origin. This turns the primary information disclosure into a viable cross-origin data theft primitive when a victim's browser is directed at a vulnerable instance.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The handler strips only the query string component and passes the raw path to file resolution logic without canonicalizing the result or verifying that the resolved path remains within the asset root.

Attack Vector

Exploitation requires only network access to the Perspective service. No authentication or user interaction is needed. An attacker issues an HTTP GET request with ../ segments in the URL path, for example targeting files such as /etc/passwd, application configuration files, or secret material. Additional details are available in the VulnCheck Advisory for Path Traversal and the Christ Bowel Blog on CVEs.

Detection Methods for CVE-2026-67200

Indicators of Compromise

HTTP request logs containing ../ or URL-encoded variants such as %2e%2e%2f in the path component of requests to the Perspective service.
Responses from Perspective returning content types or file sizes inconsistent with expected static assets.
Outbound access to Perspective endpoints from unexpected source IP ranges, particularly targeting non-asset paths.

Detection Strategies

Deploy web application firewall or reverse proxy rules that reject request paths containing traversal sequences before they reach the Perspective service.
Correlate access logs to identify sequential probing of common sensitive file paths such as /etc/passwd, /proc/self/environ, or application secret files.
Alert on any response from Perspective containing signatures of credential files or private keys.

Monitoring Recommendations

Enable verbose HTTP access logging on all Perspective instances and forward logs to a centralized analytics platform.
Monitor for anomalous cross-origin fetch patterns targeting Perspective endpoints from browser referrers.
Track file read events on the host filesystem for accesses originating from the Perspective process outside the configured asset root.

How to Mitigate CVE-2026-67200

Immediate Actions Required

Restrict network access to Perspective 5.0.0 instances to trusted networks until an official patched release is deployed.
Place Perspective behind a reverse proxy that normalizes request paths and rejects traversal sequences.
Rotate any credentials, API keys, or secrets that may be present on hosts running vulnerable Perspective instances.

Patch Information

No vendor patch information is included in the published advisory. Consult the VulnCheck Advisory for Path Traversal and the Christ Bowel Blog on CVEs for current remediation guidance and any fixed release announcements.

Workarounds

Configure the Perspective asset root on a dedicated filesystem partition that contains no sensitive files.
Remove the wildcard Access-Control-Allow-Origin: * header via an upstream proxy to limit cross-origin exposure.
Deploy WAF rules blocking request paths containing ../, ..\, %2e%2e%2f, %2e%2e/, and other encoded traversal variants.

bash

# Example nginx reverse proxy rule to block path traversal attempts
location / {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 400;
    }
    proxy_pass http://perspective_backend;
    proxy_hide_header Access-Control-Allow-Origin;
}