Path Traversal Vulnerability in Taipy GUI by Avaiga

CVE-2026-48544

What is CVE-2026-48544?

The Taipy 4.1.1 release features a vulnerability in the ElementLibrary.get_resource() method within taipy/gui/extension/library.py, allowing unauthenticated attackers to exploit an incomplete path containment check. This flaw can enable attackers to craft GET requests with path traversal segments, allowing them to bypass intended directory restrictions and potentially access files outside the intended module directory. As Flask's path converter and Werkzeug's WSGI layer preserve traversal segments, the flawed startswith comparison can be exploited, resulting in unauthorized file access.

References