Vulnerability Intelligence Report
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
CVE-2026-32981
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Path Traversal
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.93%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| ray-project | Ray | 0 < 2.8.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-03-17T11:31:56 |
| Published | 2026-03-17T19:33:50 |
| Last Updated | 2026-09-03T12:04:42 |
Community Chatter & Buzz