CVE-2026-32981

HIGH

Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

Title source: cna
STIX 2.1

Description

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure

Scores

CVSS v3 7.5
EPSS 0.0069
EPSS Percentile 47.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (3)
anyscale/ray < 2.8.1
pypi/ray 0 - 2.8.1PyPI
ray-project/Ray < 2.8.1
Published Mar 17, 2026
Tracked Since Mar 18, 2026