# CVE-2026-63445: Perses's unvalidated project parameter enables filesystem path traversal

> CVE-2026-63445 (GitHub advisory GHSA-vr5f-w35q-98jp) is a high-severity vulnerability with a CVSS 4.0 base score of 7.1, classed as Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22), in github.com/perses/perses (Go). Affected versions: < 0.54.0-rc.0. It is fixed in 0.54.0-rc.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-63445

| Field | Value |
| --- | --- |
| CVE | CVE-2026-63445 |
| GHSA | GHSA-vr5f-w35q-98jp |
| Severity | High |
| CVSS 4.0 | 7.1 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` (GitHub Advisory Database) |
| CWE | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| EPSS | 0.56% (higher than 45% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

##### Impact
When Perses is using the file system database, on  the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). 

The path is then used to retrieve files in the database directly.

Attacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to get access to other resources contained in the file database.

For example `https://localhost:8080/api/v1/dashboards?project=../projects` returns the list of the project while it must not return anything.

##### Patches
_Has the problem been patched? What versions should users upgrade to?_

##### Workarounds
Avoid using the file system database in production. Use SQL database instead.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| github.com/perses/perses | Go | `pkg:golang/github.com/perses/perses` | < 0.54.0-rc.0 | 0.54.0-rc.0 |

## Fix commits

- Patch: https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
- Release: https://github.com/perses/perses/commit/8a64dc1cbba8667597e827fdab28dda20b541466 (0.54.0-rc.0)

## Questions

**What is the GHSA ID for CVE-2026-63445?**

GitHub tracks CVE-2026-63445 as GHSA-vr5f-w35q-98jp.

**What is the CVSS score of CVE-2026-63445?**

CVE-2026-63445 has a CVSS 4.0 base score of 7.1 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

**Which versions are affected by CVE-2026-63445?**

github.com/perses/perses (Go): < 0.54.0-rc.0.

**How do I fix CVE-2026-63445?**

Upgrade to 0.54.0-rc.0 or later. The fix is in commit 75e5471.

**What is the Package URL (PURL) for CVE-2026-63445?**

The affected package's PURL is pkg:golang/github.com/perses/perses.

**Is CVE-2026-63445 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-63445. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45% of CVEs.

## References

- https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a (fix)
- https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63445.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-63445 (advisory)
- https://github.com/advisories/GHSA-vr5f-w35q-98jp (advisory)
- https://github.com/perses/perses (package)
- https://github.com/perses/perses/releases/tag/v0.54.0-rc.0

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-63445), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.