PT-2026-25933 · Anyscale · Ray

Indoushka · Publicado 2026-03-17 · Atualizado 2026-03-18 · CVE-2026-32981

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ray versions prior to 2.8.1

Description A path traversal issue exists in Ray Dashboard (default port 8265). Insufficient validation and sanitization of user-supplied paths within the static file handling mechanism allows an attacker to use traversal sequences (e.g., ../) to access files outside the intended static directory, leading to local file disclosure. The vulnerable component is the static file handling mechanism. The API endpoint is not explicitly mentioned. The vulnerable parameter is the user-supplied path.

Recommendations Update to Ray version 2.8.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32981

GHSA-J3MH-QMJJ-XP83

PYSEC-2026-130

Produtos afetados

Ray

Referências · 12

• 🔥 https://packetstorm.news/files/id/215801 · Exploit
• https://github.com/ray-project/ray · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-130.yaml · Nota
• https://twitter.com/RedPacketSec/status/2034058391107097087 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2026-130 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136472635257279 · Publicação no Twitter
• https://github.com/advisories/GHSA-j3mh-qmjj-xp83 · Nota
• https://osv.dev/vulnerability/GHSA-j3mh-qmjj-xp83 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32981 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034024977897320752 · Publicação no Twitter
• https://vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure · Nota
• https://osv.dev/vulnerability/CVE-2026-32981 · Aviso do Fabricante