CVE-2026-67200 — Perspective 5.0.0 Path Traversal via cwd_static_file_handler
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ..…
Published: 2026-08-04 · CVSS: 8.7 · CVSS 4.0
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7