GitHub Advisoryadvisory · PyPI

GHSA-j3mh-qmjj-xp83 Ray Dashboard is vulnerable to path traversal through its static file handling mechanism

HIGH Published 2026-03-17 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-32981
Ecosystem
PyPI
Packages
ray
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-06-09

Affected packages

• PyPI ray: < 2.8.1 → fixed in 2.8.1

Description

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Related

Alias · CVE (1)

  • CVE-2026-32981 A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References