CVE-2026-48544

Name of the Vulnerable Software and Affected Versions Taipy version 4.1.1

Description An issue exists in the ElementLibrary.get resource() function within taipy/gui/extension/library.py that allows unauthenticated attackers to access files outside the intended library directory. This occurs due to an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can use crafted GET requests containing path traversal segments to target sibling directories that share a common prefix. Because the Flask path converter and Werkzeug WSGI layer preserve these segments, the resolved path still satisfies the flawed comparison, enabling unauthorized file access.

Recommendations Apply the fix implemented in commit 129fd40 for version 4.1.1.