CVE-2026-32981

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32981
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32981.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32981
Aliases
Published
2026-03-17T19:33:50.107Z
Modified
2026-07-24T03:56:55.056120479Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Details

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32981.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/ray-project/ray

Affected ranges

Type
GIT
Repo
https://github.com/ray-project/ray
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3546c41b9996c36d0f1bba497dc660d3fcfc59a7
Database specific 
{
    "cpe": "cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.1"
        }
    ]
}

Affected versions

ray-0.*
ray-0.1.0
ray-0.1.1
ray-0.1.2
ray-0.2.0
ray-0.2.1
ray-0.2.2
ray-0.3.0
ray-0.3.1
ray-0.4.0
ray-0.5.0
ray-0.5.1
ray-0.5.2
ray-0.5.3
ray-0.6.0
ray-0.6.1
ray-0.6.2
ray-0.6.3
ray-0.6.4
ray-0.6.5
ray-0.7.0
ray-2.*
ray-2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32981.json"