CVE-2026-32981: Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ray Dashboardto a version that resolves this vulnerability.Fixed in 2.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32981?
The severity of CVE-2026-32981 is considered medium due to its potential for local file disclosure.
How do I fix CVE-2026-32981?
To fix CVE-2026-32981, upgrade Ray Dashboard to version 2.8.1 or later.
What causes CVE-2026-32981?
CVE-2026-32981 is caused by improper validation and sanitization of user-supplied paths in the static file handling mechanism.
What versions are affected by CVE-2026-32981?
Ray Dashboard versions up to and including 2.8.0 are affected by CVE-2026-32981.
What kind of attack can exploit CVE-2026-32981?
CVE-2026-32981 can be exploited through a path traversal attack leading to local file disclosure.