{"id":"GHSA-vr5f-w35q-98jp","summary":"Perses's unvalidated project parameter enables filesystem path traversal","details":"### Impact\nWhen Perses is using the file system database, on  the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). \n\nThe path is then used to retrieve files in the database directly.\n\nAttacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to get access to other resources contained in the file database.\n\nFor example `https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of the project while it must not return anything.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\nAvoid using the file system database in production. Use SQL database instead.","aliases":["CVE-2026-63445"],"modified":"2026-09-18T17:45:05.843505709Z","published":"2026-09-18T17:40:03Z","database_specific":{"github_reviewed_at":"2026-09-18T17:40:03Z","nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp"},{"type":"WEB","url":"https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a"},{"type":"PACKAGE","url":"https://github.com/perses/perses"},{"type":"WEB","url":"https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"}],"affected":[{"package":{"name":"github.com/perses/perses","ecosystem":"Go","purl":"pkg:golang/github.com/perses/perses"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.54.0-rc.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vr5f-w35q-98jp/GHSA-vr5f-w35q-98jp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}