{"metadata": {"vulnerability": "CVE-2026-63445", "count": 22, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 16}}, "data": [{"timestamp": "2026-07-16T19:35:57.767Z", "date_only": false, "value": "2026-07-16T19:35:57.767Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63445", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-16T20:21:44Z", "date_only": false, "value": "2026-09-16T20:21:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-16T21:24:24Z", "date_only": false, "value": "2026-09-16T21:24:24Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-17T17:17:28Z", "date_only": false, "value": "2026-09-17T17:17:28Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-18T17:38:02.870Z", "date_only": false, "value": "2026-09-18T17:38:02.870Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63445", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-18T17:38:02.870Z", "date_only": false, "value": "2026-09-18T17:38:02.870Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63445", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:40:03Z", "date_only": false, "value": "2026-09-18T17:40:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VR5F-W35Q-98JP", "record": "GHSA-VR5F-W35Q-98JP", "field": "published"}, {"timestamp": "2026-09-18T17:40:03Z", "date_only": false, "value": "2026-09-18T17:40:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VR5F-W35Q-98JP", "record": "GHSA-VR5F-W35Q-98JP", "field": "modified"}, {"timestamp": "2026-09-18T18:04:06.862Z", "date_only": false, "value": "2026-09-18T18:04:06.862464Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63445", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-18T18:04:06.862Z", "date_only": false, "value": "2026-09-18T18:04:06.862464Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63445", "record": "FKIE_CVE-2026-63445", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-18T18:04:16.733Z", "date_only": false, "value": "2026-09-18T18:04:16.733Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63445", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T18:04:16.733Z", "date_only": false, "value": "2026-09-18T18:04:16.733Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63445", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T18:17:10.477Z", "date_only": false, "value": "2026-09-18T18:17:10.477", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63445", "record": "FKIE_CVE-2026-63445", "field": "published"}, {"timestamp": "2026-09-19T04:31:14.039Z", "date_only": false, "value": "2026-09-19T04:31:14.039176Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/e2d55cbe70e0ef271b1abdc363b67704", "record": "CVE-2026-63445", "field": "creation_timestamp", "uuid": "7bea6e97-8f44-41d7-ae63-f23a81920938", "content": "# CVE-2026-63445: CVE-2026-63445: Arbitrary File Read and Path Traversal in Perses File-System Database Backend\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63445\n\n## Summary\nAn arbitrary file read and path traversal vulnerability exists in Perses prior to version 0.54.0-rc.0. When configured with a file-system database backend, the application lacks input validation on the request-controlled project query parameter. An authenticated attacker with low privileges can supply directory traversal sequences to read arbitrary JSON or YAML files on the host file system.\n\n## TL;DR\nUnvalidated project query parameters in Perses allow authenticated path traversal and arbitrary JSON/YAML file reading when using the file-system database.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.1\n- **Privileges Required**: Low\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Perses (observability dashboard and visualization project)\n- **Perses**: < 0.54.0-rc.0 (Fixed in: `0.54.0-rc.0`)\n\n## Mitigation\n\n- Upgrade Perses to version 0.54.0-rc.0 or later to enforce strict input validation.\n- Deploy Web Application Firewall (WAF) rules to detect and block path traversal sequences in query parameters.\n- Apply the principle of least privilege to the host process execution environment.\n\n**Remediation Steps:**\n1. Identify all Perses deployments running versions prior to 0.54.0-rc.0.\n2. Back up the local database files located in the storage directory.\n3. Update the Perses container image or binary to version 0.54.0-rc.0 or a later stable release.\n4. Verify that requests with traversal parameters return a 400 Bad Request error.\n5. Ensure the Perses service runs under a non-root system user account.\n\n## References\n\n- [GitHub Security Advisory GHSA-vr5f-w35q-98jp](https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp)\n- [NVD Vulnerability Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-63445)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-63445)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63445) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/e2d55cbe70e0ef271b1abdc363b67704"}, {"timestamp": "2026-09-19T08:19:45Z", "date_only": false, "value": "2026-09-19T08:19:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-09-20T21:49:08Z", "date_only": false, "value": "2026-09-20T21:49:08Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-09-20T21:49:08Z", "date_only": false, "value": "2026-09-20T21:49:08Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-24T21:25:27.050Z", "date_only": false, "value": "2026-09-24T21:25:27.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63445", "record": "FKIE_CVE-2026-63445", "field": "lastModified"}]}