While validation logic exists for Create and Update operations, it is absent for List operations. Consequently, an unauthenticated attacker can manipulate the project parameter in API requests (e.g., /api/v1/dashboards?project=../) to traverse outside intended directories. This allows the reading of arbitrary YAML or JSON files residing on the host server, potentially exposing sensitive resource configurations and bypassing internal security controls. This vulnerability affects all versions of Perses prior to v0.54.0-rc.0.

Impact

Successful exploitation allows attackers to gain unauthorized access to arbitrary YAML and JSON files stored on the server host. This information disclosure can lead to the exposure of proprietary configurations and internal resource metadata, undermining the security model of the Perses deployment. Organizations using the filesystem database backend are at high risk, as this configuration is inherently vulnerable to this traversal attack.

Recommendation

• Upgrade Perses to version 0.54.0-rc.0 or later immediately to patch CVE-2026-63445.
• If upgrading is not immediately feasible, migrate the database backend from the filesystem to an SQL-based database as a workaround.
• Inspect web server and application logs for unusual URL parameters containing directory traversal sequences (e.g., "../") directed at list endpoints such as /api/v1/dashboards.