---
id: CVE-2026-63445
title: >-
  Perses is an open-source dashboard and visualization project for observability
  data
summary: >-
  Perses is an open-source dashboard and visualization project for observability
  data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database
  bind the request-controlled project query parameter into the resource Query
  stru…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: perses
product: github.com/perses/perses
affected:
  - github.com/perses/perses < 0.54.0-rc.0
patched:
  - github.com/perses/perses 0.54.0-rc.0
published: '2026-09-18'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63445'
references:
  - url: >-
      https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
    label: security-advisories@github.com
  - url: 'https://github.com/perses/perses/releases/tag/v0.54.0-rc.0'
    label: security-advisories@github.com
  - url: 'https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-vr5f-w35q-98jp'
  - url: 'https://github.com/perses/perses'
tags:
  - nvd
  - ghsa
  - go
  - cve.org
  - osv
epss: 0.00561
epssPercentile: 0.44306
aliases:
  - GHSA-vr5f-w35q-98jp
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T18:04:06.862464Z'
cvssSource: cna
ingestedAt: '2026-09-18T17:46:41.527Z'
---

## Overview

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources. This issue is fixed in version 0.54.0-rc.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63445)

Affected packages:

- `github.com/perses/perses < 0.54.0-rc.0`

Patched in:

- `github.com/perses/perses 0.54.0-rc.0`

Source: https://github.com/advisories/GHSA-vr5f-w35q-98jp