A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Because user‑supplied paths are not properly validated or sanitized in the static file handling mechanism, an attacker can supply traversal sequences such as ../ to read files outside the intended static directory. This results in local file disclosure, potentially exposing sensitive data on the host system. The weakness is classified as CWE‑22.

The vulnerability affects Ray Project’s Ray software, specifically Ray Dashboard versions <=2.8.0. Any deployment of Ray on a system running a version before 2.8.1 is impacted, as indicated by the vendor’s CPE string cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*.

The CVSS score is 8.7, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require the attacker to send a crafted HTTP request to the Ray Dashboard service on port 8265, which may be reachable over the local network or exposed externally. Once the request is accepted, the attacker can read arbitrary files from the host, compromising confidentiality and potentially enabling further attacks if privileged data is disclosed.