CVE-2026-48544: Avaiga Taipy path traversal in ElementLibrary.get_resource

CVE-2026-48544 · Severity: high · CVSS 7.5 · Published 2026-05-27

Taipy is a Python library used for building data-driven web applications. A security flaw in how the software handles file requests allows an unauthenticated attacker to access sensitive files on the server that should be restricted. This could lead to the exposure of private data or configuration files, potentially compromising the entire application environment.

Technologies: taipy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48544 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48544 being exploited in the wild.
How severe is CVE-2026-48544?
High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?
Avaiga Taipy <= 4.1.1; taipy (PyPI) ECOSYSTEM:introduced=0,last_affected=4.1.1.
Is there a fix for CVE-2026-48544?
A patch was published on 2026-04-30: Fix merged into develop branch via commit 129fd40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48544 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48544?
Check whether you run Avaiga Taipy or taipy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the ElementLibrary.get_resource() method within taipy/gui/extension/library.py. The vulnerability stems from an incomplete path containment check that uses str.startswith() without ensuring a trailing path separator is present. An unauthenticated attacker can exploit this by sending crafted GET requests with path traversal segments (e.g., ../) targeting sibling directories that share a name prefix with the intended directory. Because Flask and Werkzeug preserve these segments during certain processing phases, the flawed check is bypassed, allowing unauthorized read access to files on the host system. The issue is addressed in commit 129fd40 by replacing the prefix check with a proper path relativity check.

Affected products

  • Avaiga Taipy <= 4.1.1

Identifiers

  • CVE-2026-48544
  • GHSA-28gh-q3gw-pvx8
  • PYSEC-2026-3081

Timeline

  • 2026-04-29: disclosed: Issue reported on GitHub
  • 2026-04-30: patched: Fix merged into develop branch via commit 129fd40
  • 2026-05-27: advisory: GitHub Advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.