CVE-2026-67200: Perspective 5.0.0 Path Traversal via cwd_static_file_handler
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67200?
CVE-2026-67200 has a high severity rating of 7.5.
How do I fix CVE-2026-67200?
The vulnerability in CVE-2026-67200 can be mitigated by upgrading Perspective to a patched version that addresses the path traversal issue.
What type of attack is described in CVE-2026-67200?
CVE-2026-67200 describes a path traversal attack that allows unauthorized access to files on the server.
Who is affected by CVE-2026-67200?
CVE-2026-67200 affects users of Perspective 5.0.0 who have not implemented proper security measures against path traversal.
What impact does CVE-2026-67200 have?
CVE-2026-67200 allows attackers to read arbitrary files from the server filesystem, potentially exposing sensitive information.