RayGHSA-j3mh-qmjj-xp83
Ray Dashboard is vulnerable to path traversal through its static file handling mechanism
Fix: upgrade to 2.8.1 or later
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ray PyPI | < 2.8.1 | 2.8.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-32981, PYSEC-2026-130