CVE-2026-67200
Received Received - Intake

Path Traversal in Perspective 5.0.0

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-67200
EUVD
EUVD-2026-52696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perspective perspective 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67200 is a path traversal vulnerability in Perspective 5.0.0. It allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including ../ segments in HTTP request URLs. The insufficient query-string-stripping sanitization lets attackers bypass restrictions and access sensitive files like system credentials and application secrets. A wildcard Access-Control-Allow-Origin header exposes results cross-origin.

Detection Guidance

To detect this vulnerability, check HTTP responses for files outside the intended directory by sending requests with ../ segments in URLs. Use curl commands like: curl -v 'http://target.com/path/../../etc/passwd' or wget 'http://target.com/path/../../etc/passwd'. Monitor for successful reads of sensitive files.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on the server, including system credentials and application secrets. Attackers could exploit it to steal confidential data, compromise the server, or gain further access to the system. The cross-origin exposure increases the risk of data leakage to unauthorized domains.

Compliance Impact

This vulnerability could lead to breaches of GDPR and HIPAA by exposing sensitive personal or health data. Unauthorized access to credentials or secrets may violate compliance requirements for data protection and security controls, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade Perspective to a version beyond 5.0.0 if available. If not, restrict access to the server, disable directory traversal in web server configs, and review file permissions. Implement input validation to strip ../ sequences from URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart