CVE-2026-48544

HighCVSS 7.5

Published: 27/05/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

A path traversal vulnerability in Taipy 4.1.1 (fixed in commit 129fd40) exists in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py. Unauthenticated attackers can bypass an incomplete path containment check using str.startswith() without a trailing path separator by sending crafted GET requests with path traversal segments, allowing unauthorized file access outside the intended library directory.

Risk Assessment

The risk involves unauthorized file read access outside the library directory, potentially exposing sensitive application data or server configuration.

Recommendation

Immediately update Taipy to a version containing commit 129fd40 or later, which includes proper path validation with a trailing separator.

Other vulnerabilities in Taipy

CVE-2026-85183Critical
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

Original NVD description (English source)

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory.