CVE-2026-48129: Kestra task inputFiles accepts traversal filenames for worker file writes
Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task inputFiles writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an inputFiles file name, a caller can use ../ path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kestra (task inputFiles)to a version that resolves this vulnerability.Fixed in 1.3.19 - Upgrade
Upgrade
Kestra (task inputFiles)to a version that resolves this vulnerability.Fixed in 1.2.19 - Upgrade
Upgrade
Kestra (task inputFiles)to a version that resolves this vulnerability.Fixed in 1.1.19 - Upgrade
Upgrade
Kestra (task inputFiles)to a version that resolves this vulnerability.Fixed in 1.0.43
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-48129?
CVE-2026-48129 has a risk level of 45, categorized as medium severity.
What is the impact of CVE-2026-48129?
CVE-2026-48129 potentially allows for unauthorized file writes due to path traversal vulnerabilities.
How do I mitigate CVE-2026-48129?
To mitigate CVE-2026-48129, update Kestra to versions 1.3.19, 1.2.19, 1.1.19, or 1.0.43 or later.
What types of systems are affected by CVE-2026-48129?
CVE-2026-48129 affects Kestra versions prior to the specified secure releases listed.
What applications of Kestra are involved with CVE-2026-48129?
CVE-2026-48129 affects the `inputFiles` functionality in Kestra for task file writing.