CVE-2026-63445

Name of the Vulnerable Software and Affected Versions Perses versions prior to 0.54.0-rc.0

Description When using the file-system database, list endpoints bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters. This allows an authenticated attacker to use directory traversal segments to exit the intended project directory, read arbitrary YAML or JSON files accessible to the process, and bypass project isolation to enumerate other file-backed resources. An example of this occurs at the /api/v1/dashboards endpoint when the project parameter is manipulated.

Recommendations Update to version 0.54.0-rc.0 or later. Avoid using the file system database in production and use a SQL database instead.