CVE-2026-63445
HighCVSS 7.1Summary
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation.
Risk Assessment
An authenticated attacker can bypass project isolation and read arbitrary YAML or JSON files accessible to the Perses process, potentially exposing sensitive configuration data or other resources.
Recommendation
Update Perses to version 0.54.0-rc.0 or later. Consider validating the project parameter against directory traversal characters.
Other vulnerabilities in Perses
See all- CVE-2026-63458High
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project.
- CVE-2026-63199High
Perses versions 0.43.0 through 0.54.0-rc.0 authorize datasource creation and unsaved datasource proxy paths on a Datasource or GlobalDatasource scope without requiring read permission for the separately grantable associated project or global Secret. A low-privilege user can attach a Secret they cannot read, point the datasource at a user-controlled service, and cause Perses to send the decrypted secret in plaintext, bypassing scope separation.
Original NVD description (English source)
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.