Taipy 4.1.1 contains a path traversal flaw in the ElementLibrary.get_resource() function that fails to correctly validate the target path. The bug is caused by using a startswith comparison without a trailing separator, allowing attackers to craft requests that resolve to directories outside the intended module folder. When an attacker supplies a GET request containing traversal segments such as ../, the vulnerable check mistakenly permits the path because the resolved absolute path still begins with the expected module prefix. This flaw permits reading files that are not part of the library, leading to confidential data leakage. The vulnerability is classified as CWE-22.

Avaiga's Taipy product, specifically version 4.1.1. The issue was fixed in commit 129fd407ffca49ee4ab853772c88d0c873e038dd and is not present in later releases.

The CVSS score is 8.7, indicating a high severity. Although an EPSS score is not available, the lack of authentication requirements makes exploitation straightforward for anyone able to send HTTP requests to the application. The vulnerability is not yet listed in the CISA KEV catalog, but the high impact and ease of exploitation warrant immediate attention. Attackers can trigger it by accessing a URL that includes traversal segments, and the application will serve files located outside the intended directory, potentially exposing sensitive configuration or system files.