PT-2026-25933 · Anyscale · Ray

Indoushka · Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-32981

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ray versions prior to 2.8.1

Description A path traversal issue exists in Ray Dashboard (default port 8265). Insufficient validation and sanitization of user-supplied paths within the static file handling mechanism allows an attacker to use traversal sequences (e.g., ../) to access files outside the intended static directory, leading to local file disclosure. The vulnerable component is the static file handling mechanism. The API endpoint is not explicitly mentioned. The vulnerable parameter is the user-supplied path.

Recommendations Update to Ray version 2.8.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32981

GHSA-J3MH-QMJJ-XP83

PYSEC-2026-130

Affected Products

Ray

References · 12

• 🔥 https://packetstorm.news/files/id/215801 · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-130 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3mh-qmjj-xp83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32981 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32981 · Vendor Advisory
• https://github.com/ray-project/ray · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-130.yaml · Note
• https://twitter.com/RedPacketSec/status/2034058391107097087 · Twitter Post
• https://twitter.com/CVEnew/status/2034136472635257279 · Twitter Post
• https://github.com/advisories/GHSA-j3mh-qmjj-xp83 · Note
• https://twitter.com/VulmonFeeds/status/2034024977897320752 · Twitter Post
• https://vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure · Note