Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-63445, describes a path traversal issue in Perses when using the file system database. Specifically, the project parameter in list endpoints was not validated, allowing attackers to read arbitrary files. The provided commit 75e5471040ccb5674ea8d25c2aa16c80ccb70b2a directly addresses this vulnerability. Analyzing the patch for internal/api/toolbox/list.go, it's clear that a validation step common.ValidateID(projectQueryParameter) was added to the list function. This indicates that in the vulnerable version, the projectQueryParameter was processed by the list function without this crucial validation, making toolbox.list the vulnerable function. Exploitation would involve calling this list function with a specially crafted project parameter. The GetProjectQueryParam() method is used to retrieve the parameter, and then list directly uses it without sanitization, leading to the path traversal.
toolbox.listinternal/api/toolbox/list.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/perses/perses | go | < 0.54.0-rc.0 | 0.54.0-rc.0 |