Executive brief
Perses is an open-source monitoring and visualization platform. When configured to use the filesystem database, attackers with low-level access to the API can supply specially crafted project parameters containing path traversal characters (e.g., `../`) to read arbitrary YAML and JSON files outside the intended database directory. This allows unauthorized access to sensitive configuration data and resources that should be restricted.
Technical details
The vulnerability is a path traversal (CWE-22) in Perses's list endpoints when using a filesystem-backed database. The project parameter from HTTP requests is bound directly to a Query struct without validation for directory-traversal characters like `../`, whereas Create/Update operations include such validation. The unsanitized path is then used to directly access files on disk, allowing attackers to traverse the filesystem. Attack vector is network-based, requires low privileges (authenticated user) and low complexity. An attacker can read arbitrary YAML/JSON files outside the intended project directory and bypass security constraints to access restricted resources. The issue is patched in version 0.54.0-rc.0 and later.
Affected products
- Perses Perses < 0.54.0-rc.0
Timeline
- 2026-09-18: disclosed: Published in GitHub Advisory Database
- 2026-09-18: patched: Fixed in version 0.54.0-rc.0