Executive brief
Kestra is an open-source platform used to automate and orchestrate complex data workflows. A security flaw allows attackers to bypass directory restrictions by sending specially crafted data through webhooks or task inputs. This could allow an unauthorized user to create or overwrite sensitive files on the server running the automation, potentially leading to system instability or data corruption.
Technical details
A path traversal vulnerability exists in Kestra's `FilesService.inputFiles()` component. The application fails to sanitize rendered file names when processing the `inputFiles` dynamic task property, which can be populated via untrusted execution or webhook data. By using `../` path segments in a file name, an attacker can escape the task's working directory and write or overwrite arbitrary files on the worker's filesystem with the privileges of the Kestra worker process. While direct Remote Code Execution (RCE) was not confirmed, the primitive allows for significant integrity impact and potential downstream exploitation. The issue is patched in versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43.
Affected products
- kestra-io Kestra < 1.0.43, >= 1.1.0 < 1.1.19, >= 1.2.0 < 1.2.19, >= 1.3.0 < 1.3.19
Timeline
- 2026-05-26: advisory: GitHub Security Advisory GHSA-q3fw-mvgv-pjr2 published
- 2026-06-19: disclosed: CVE-2026-48129 published to NVD