Vulnerability · Published May 27, 2026 · Assigned by VulnCheck

CVE-2026-48544Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()

High 7.5

In plain English

A high-severity path traversal in taipy from Avaiga. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by exploiting an incomplete path containment check using str.startswith() without a trailing path separator. Attackers can send crafted GET requests with path traversal segments targeting a prefix-matching sibling directory on disk, bypassing the directory containment check because Flask's path converter and Werkzeug's WSGI layer preserve the traversal segments while the resolved path still satisfies the flawed startswith comparison, enabling unauthorized file access outside the intended library directory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	taipy	no fix listed	GHSA-28gh-q3gw-pvx8
PyPI	taipy	no fix listed	PYSEC-2026-3081

Affected products (as reported)

Vendor	Product	Versions
Avaiga	taipy	0 – through 4.1.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/Avaiga/taipy/issues/2868 issue-tracking
https://github.com/Avaiga/taipy/pull/2871 issue-tracking
https://github.com/Avaiga/taipy/commit/129fd407ffca49ee4ab853772c88d0c873e038dd patch
https://www.vulncheck.com/advisories/taipy-path-traversal-via-elementlibrary-get-resource third-party-advisory