Perses project parameter flaw enables path traversal vulnerability

The GitHub Security Advisory database has disclosed a high-severity vulnerability in the perses/perses project, published on September 18, 2026. The issue arises from an unvalidated project parameter in the file system database, which allows attackers to perform filesystem path traversal via list endpoints. This flaw enables unauthorized access to arbitrary YAML/JSON files on the server host and bypasses security constraints, potentially exposing sensitive resources. For example, a crafted query such as ` could improperly return data from restricted directories.

Operators should assess their current database configuration before upgrading or applying workarounds. Specifically, if the file system database is in use, switching to an SQL database is recommended to mitigate the risk. This vulnerability highlights the importance of validating user input across all endpoints, not just those handling Create/Update operations.