{"id":"CVE-2026-32981","published":"2026-03-17T19:33:50Z","modified":"2026-10-08T15:22:30Z","title":"Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure","vendor":"ray-project","product":"Ray","tier":"tail","description":{"text":"A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00945,"percentile":0.6096,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://packetstorm.news/files/id/215801/","tags":["exploit"]},{"url":"https://github.com/ray-project/ray","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure","tags":["third-party-advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32981","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448440","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32981.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6761","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5809","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6762","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":12.19},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"ray-project","affectedVersions":[{"vendor":"ray-project","product":"Ray","versions":["< 2.8.1"]}],"affected":[{"ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"from":["GHSA-j3mh-qmjj-xp83","PYSEC-2026-130"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-12635","exploited":false,"provenance":"source"},"exploitRefs":["https://packetstorm.news/files/id/215801/","https://packetstorm.news/files/id/215801"]}