Executive brief
Perspective is an analytics and data visualization tool used in dashboards and reporting systems across financial and corporate environments. A path traversal vulnerability allows attackers to read any file on the server—including credentials, API keys, and application secrets—without authentication by manipulating HTTP request paths. The attacker can access sensitive files cross-origin due to overly permissive security headers.
Technical details
The vulnerability exists in Perspective 5.0.0's static file handler (cwd_static_file_handler) and is classified as CWE-22 (path traversal). The root cause is insufficient sanitization of query strings in HTTP request URL paths, which allows attackers to include literal "../" segments to escape the configured asset root directory. No authentication is required; the attack is triggered over the network via HTTP requests. An attacker can retrieve arbitrary files from the server filesystem, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header on all responses. The vulnerability has a CVSS score of 8.7 (network-reachable, unauthenticated, high confidentiality impact).
Affected products
- Perspective Perspective 5.0.0
Timeline
- 2026-08-04: disclosed