CVE-2026-48129

Kestra task inputFiles accepts traversal filenames for worker file writes

State: Published
Severity: 6.5 Medium
Published: Jun 19, 2026
Updated: Jun 23, 2026
Reserved: May 20, 2026

Description

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
kestrakestra-io	< 1.0.43Affected >= 1.1.0, < 1.1.19Affected >= 1.2.0, < 1.2.19Affected >= 1.3.0, < 1.3.19Affected

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.