CVE-2026-67200

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0

Description An issue exists that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. By including literal ../ segments in HTTP request URL paths, attackers can bypass insufficient query-string-stripping sanitization to traverse outside the configured asset root directory. This allows the retrieval of sensitive files, including system credentials and application secrets. The results are exposed cross-origin because a wildcard Access-Control-Allow-Origin header is set on all responses. The flaw is located in the cwd static file handler function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.