CVE-2026-67200
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Perspective 5.0.0 contains a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths.
Risk Assessment
Attackers can access sensitive files such as system credentials and application secrets, potentially leading to full compromise.
Recommendation
Update Perspective to a patched version and implement path validation and CORS restrictions.
Other vulnerabilities in Perspective
See all- CVE-2026-67199Medium
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
- CVE-2026-67198High
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher allowing unauthenticated attackers to crash the server process by sending malformed or incomplete protobuf messages.
- CVE-2026-67195High
Perspective 5.0.0 contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes input directly to Python's eval().
- CVE-2026-67196Medium
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.
Original NVD description (English source)
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.