CVE-2026-48544: Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()

Synopsis

A path traversal vulnerability in Taipy 4.1.1 allows unauthenticated remote attackers to read arbitrary files outside the intended extension library directory. The flaw lives in the ElementLibrary.get_resource() method, which uses a flawed str.startswith() check without a trailing path separator to enforce directory containment, letting crafted GET requests escape the sandbox. Successful exploitation gives an attacker read access to files anywhere on disk that the Taipy process can reach. A patched-image rebuild pinned to commit 129fd407ffca49ee4ab853772c88d0c873e038dd is available on HarborGuard for environments running the affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP GET requests to the Taipy application to exploit this flaw.

• AuthenticationNot required

  No credentials or account are needed; the get_resource() endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to craft a working traversal payload.

Blast Radius

• An attacker can read any file accessible to the Taipy process, including application source code, configuration files, and private keys stored on the host filesystem.
• Secrets such as database credentials, API tokens, and environment variable files outside the intended library directory can be exfiltrated in a single crafted GET request.
• No modification or availability impact is associated with this vulnerability; the attacker gains read-only access but cannot write or delete files through this vector.