CVE-2026-67200

7.5 HIGH

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows unauthenticated attackers to read arbitrary files from the server filesystem by manipulating HTTP request paths, potentially exposing sensitive information.
Exploitability: Exploitation is relatively easy as it requires only URL manipulation and no authentication; preconditions include the presence of vulnerable file paths in the asset root directory.
Blast radius: If exploited, this vulnerability could lead to significant data breaches, including system credentials and application secrets being exposed cross-origin.
Prioritized remediation: Update Perspective to a non-vulnerable version or patch the path traversal vulnerability by properly sanitizing input and restricting file access paths.

path-traversalfile-readwebauth-bypass

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.