# CVE-2026-63445: Perses: Unvalidated project parameter enables filesystem path traversal

- Exploited (CISA KEV): no
- Published: 2026-09-18
- CVSS: 7.1 HIGH (v4.0)
- EPSS: 0.6% (47th percentile)
- CWE: CWE-22

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

3 posts seen since 2026-11-02.

- mastodon 2026-11-02: CVE-2026-63445: Path traversal in Perses (pre-0.54.0-rc.0) lets an authenticated attacker read arbitrary YAML files via list endpoints. CVSS 6.5. Patch still under review, so watch for the rc and restrict access now. # CVE # infosec # cybersecurity https://www. valtersit.com/cve… (https://mastodon.social/@hugovalters/117548738294610047)
- bluesky 2026-11-02: CVE-2026-63445: Path traversal in Perses (pre-0.54.0-rc.0) lets an authenticated attacker read arbitrary YAML files via list endpoints. CVSS 6.5. Patch still under review, so watch for the rc and restrict access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE… (https://bsky.app/profile/hugovalters.bsky.social/post/3mze63dxm6b2h)
- x 2026-11-02: CVE-2026-63445: Path traversal in Perses (pre-0.54.0-rc.0) lets an authenticated attacker read arbitrary YAML files via list endpoints. CVSS 6.5. Patch still under review, so watch for the rc and restrict access now. #CVE #infosec #cybersecurity https://t.co/8DfFLLLQqn  #Perses (https://x.com/HugoValters/status/2117352294832619772)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-63445 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-63445