The vulnerability allows an authenticated attacker to supply directory traversal characters in the project query parameter, enabling the system to access files outside the intended project directory. This can expose sensitive configuration files in YAML or JSON format, leading to confidentiality compromise. The weakness is a classic path‑traversal flaw, classified under CWE‑22.

The issue affects Perses deployments using the perses:perses product and applies to all versions released before 0.54.0‑rc.0. Any installation that has not upgraded to 0.54.0‑rc.0 or later is susceptible.

With a CVSS score of 7.1, the vulnerability poses a high risk. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation cases at the time of analysis. An attacker who authenticates to the Perses API can craft the project parameter to traverse directories, read arbitrary files accessible to the Perses process, and bypass project isolation. The attack path is straightforward and does not require advanced techniques, suggesting the potential for widespread exploitation if left unpatched.