Executive brief
Kestra is an open-source platform used to orchestrate complex data workflows and event-driven tasks. A security flaw in how the system handles file paths allows an authenticated user to bypass security checks and read sensitive files from the underlying server. This could result in the exposure of system configuration files, passwords, or data belonging to other users on the same platform.
Technical details
A path traversal vulnerability exists in Kestra's `StorageInterface.parentTraversalGuard` due to improper validation of URL-encoded sequences. The guard checks the literal `URI.toString()` for '..' segments, which can be bypassed using encoded strings like `%2E%2E`. Downstream, `URI.getPath()` decodes these sequences back into '..', and the resulting path is passed to `Paths.get()` without normalization. An authenticated attacker with `EXECUTION:READ` permissions can exploit this via multiple API endpoints (e.g., `ExecutionController` and `NamespaceFileController`) to read any file accessible to the Kestra process, such as `/etc/passwd` or secrets. The issue is fixed in versions 1.0.43 and 1.3.19.
Affected products
- kestra-io kestra-core < 1.0.43, >= 1.1.0 < 1.3.19
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: NVD publication date