# CVE-2026-63445: Perses filesystem path traversal via unvalidated project parameter

Source: https://junglewise.ai/threats/cve-2026-63445-perses-filesystem-path-traversal-via-unvalidated-project  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63445 · Severity: high · CVSS 4 · Published 2026-09-18

Perses is an open-source monitoring and visualization platform. When configured to use the filesystem database, attackers with low-level access to the API can supply specially crafted project parameters containing path traversal characters (e.g., `../`) to read arbitrary YAML and JSON files outside the intended database directory. This allows unauthorized access to sensitive configuration data and resources that should be restricted.

Technologies: [github.com/perses/perses (Go)](https://junglewise.ai/threats/technologies/github-com-perses-perses), [Perses](https://junglewise.ai/threats/technologies/perses). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Perses](https://junglewise.ai/threats/vendors/perses).

## Quick answers

**Is CVE-2026-63445 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63445 being exploited in the wild.

**How severe is CVE-2026-63445?** High severity, with a CVSS score of 4, published 18 September 2026.

**Which products and versions are affected?** github.com/perses/perses (Go) < 0.54.0-rc.0, SEMVER:introduced=0,fixed=0.54.0-rc.0; Perses < 0.54.0-rc.0.

**Is there a fix for CVE-2026-63445?** Yes. github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63445 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-63445?** Check whether you run github.com/perses/perses (Go) or Perses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later

  ```sh
  go get github.com/perses/perses@v0.54.0-rc.0
  ```


## Technical details

The vulnerability is a path traversal (CWE-22) in Perses's list endpoints when using a filesystem-backed database. The project parameter from HTTP requests is bound directly to a Query struct without validation for directory-traversal characters like `../`, whereas Create/Update operations include such validation. The unsanitized path is then used to directly access files on disk, allowing attackers to traverse the filesystem. Attack vector is network-based, requires low privileges (authenticated user) and low complexity. An attacker can read arbitrary YAML/JSON files outside the intended project directory and bypass security constraints to access restricted resources. The issue is patched in version 0.54.0-rc.0 and later.

## Affected products

- Perses Perses < 0.54.0-rc.0

## Identifiers

- CVE-2026-63445
- GHSA-vr5f-w35q-98jp
- GO-2026-6528

## Timeline

- 2026-09-18: disclosed: Published in GitHub Advisory Database
- 2026-09-18: patched: Fixed in version 0.54.0-rc.0

## References

- [https://api.github.com/users/bhilaire1a](https://api.github.com/users/bhilaire1a)

## Related threats

- [Perses project query parameter authorization bypass](https://junglewise.ai/threats/cve-2026-63458-perses-project-query-parameter-authorization-bypass)
- [Perses missing authorization in datasource proxy](https://junglewise.ai/threats/cve-2026-63199-perses-missing-authorization-in-datasource-proxy)