# CVE-2026-49984: Kestra path traversal in LocalStorage via backslash smuggling

Source: https://junglewise.ai/threats/cve-2026-49984-kestra-path-traversal-in-localstorage-via-backslash-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-49984 · Severity: high · CVSS 7.7 · Published 2026-06-26

Kestra, an open-source event-driven orchestration platform, is vulnerable to a security flaw that allows authenticated users to bypass storage restrictions. By using specific character sequences in file paths, an attacker can escape the intended storage sandbox to read sensitive files on the server. This could lead to the exposure of internal databases, secret credentials, and configuration files, potentially compromising the entire platform and all data managed within it.

Technologies: [Kestra](https://junglewise.ai/threats/technologies/kestra). Vendors: [Kestra](https://junglewise.ai/threats/vendors/kestra).

## Quick answers

**Is CVE-2026-49984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49984 being exploited in the wild.

**How severe is CVE-2026-49984?** High severity, with a CVSS score of 7.7, published 26 June 2026.

**Which products and versions are affected?** Kestra < 1.0.45, >= 1.1.0, < 1.3.23.

**Is there a fix for CVE-2026-49984?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49984 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49984?** Check whether you run Kestra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Kestra's LocalStorage backend due to a 'validate-before-canonicalize' error (CWE-180). The `parentTraversalGuard` method checks for traversal sequences like '../' but fails to account for Windows-style backslashes ('..\'). The application subsequently calls `windowsToUnixPath`, which converts these backslashes into forward slashes after the security check has already passed. An authenticated attacker with the lowest-privilege role (viewing executions) can exploit the `GET /api/v1/{tenant}/executions/{executionId}/file` endpoint by smuggling a traversal sequence. This allows for arbitrary file read access to the server filesystem, including the H2 database, secrets, and process environment variables. The issue is fixed in versions 1.0.45 and 1.3.23.

## Affected products

- kestra-io Kestra < 1.0.45, >= 1.1.0, < 1.3.23

## Timeline

- 2026-06-26: advisory
- 2026-06-26: disclosed

## References

- [https://github.com/kestra-io/kestra/security/advisories/GHSA-qw4v-6w32-xx9h](https://github.com/kestra-io/kestra/security/advisories/GHSA-qw4v-6w32-xx9h)

## Related threats

- [Kestra stored XSS via custom Markdown link attribute injection](https://junglewise.ai/threats/cve-2026-55839-kestra-stored-xss-via-custom-markdown-link-attribute-injection)
- [Kestra Server-Side Request Forgery via Pebble http() function](https://junglewise.ai/threats/cve-2026-73247-kestra-server-side-request-forgery-via-pebble-http-function)
- [Kestra unauthenticated worker endpoint exposes task credentials](https://junglewise.ai/threats/cve-2026-73246-kestra-unauthenticated-worker-endpoint-exposes-task-credentials)
- [Kestra unauthenticated management endpoints on port 8081](https://junglewise.ai/threats/cve-2026-73245-kestra-unauthenticated-management-endpoints-on-port-8081)
- [Kestra OSS weak password hashing in BasicAuth component](https://junglewise.ai/threats/cve-2026-55069-kestra-oss-weak-password-hashing-in-basicauth-component)