Perses: Unvalidated project parameter enables filesystem path traversal

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-63445 · Microsoft / collected KEV context

EUVD-2026-83268

GHSA-vr5f-w35q-98jp

GO-2026-6528

cve-program · CVE-2026-63445

• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp
• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0

euvd · EUVD-2026-83268

• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp
• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0

nvd · CVE-2026-63445

• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0
• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp

osv · GHSA-vr5f-w35q-98jp

• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp
• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0

osv · GO-2026-6528

• https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp
• https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
• https://github.com/perses/perses/releases/tag/v0.54.0-rc.0

No related operational record is retained in the current change model.