CVE-2026-48129CWE-22

Kestra task inputFiles accepts traversal filenames for worker file writes

Medium · published June 19, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-19T20:16Z
EPSS history
Timeline
  • 19 JUN 20:16Z
    Kestra task inputFiles accepts traversal filenames for worker file writes
    cvelistv5