The Perses project, when configured with a filesystem database, fails to validate the project parameter in list requests, enabling unauthorized directory traversal and arbitrary file read access.
Perses +2
web-vulnerability
path-traversal
security-misconfiguration
authorization-bypass
cve-2026-63458
1r
2t
1c
updated