CVE-2026-48129

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.3.19 Kestra versions prior to 1.2.19 Kestra versions prior to 1.1.19 Kestra versions prior to 1.0.43

Description Kestra is an open-source, event-driven orchestration platform. The inputFiles task writes rendered file names directly under the task working directory. If a flow forwards untrusted execution or webhook data into an inputFiles file name, a caller can use ../ path segments to create or overwrite files outside the task working directory on the worker filesystem. This is a path traversal issue, where ../ sequences are used to access and manipulate files and directories outside the intended folder.

Recommendations Update to version 1.3.19 Update to version 1.2.19 Update to version 1.1.19 Update to version 1.0.43