CVE-2026-32981 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-32981 PUBLISHED CVSS 8.699999809265137 HIGH

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

EPSS 0.08% · 23.7th percentile

Risk Scores

CVSS v4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.08%

23.7th percentile

Affected Products

Vendor	Product	Versions
ray-project	Ray	0, 0, 0
anyscale	ray	0, 0, 0

Timeline

Mar 17, 2026 PoC Published
Mar 17, 2026 CVE Published
Mar 17, 2026 PoC Published
Mar 17, 2026 CVE Updated
Mar 18, 2026 EPSS Score
Mar 18, 2026 PoC Published
Mar 19, 2026 EPSS Score
Mar 20, 2026 EPSS Score
Mar 20, 2026 PoC Published
Mar 21, 2026 EPSS Score
Mar 22, 2026 EPSS Score
Mar 22, 2026 Coalition ESS Score

References

https://packetstorm.news/files/id/215801/ exploit
https://github.com/ray-project/ray url
VulnCheck Advisory: Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure third-party-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32981 advisory
https://packetstorm.news/files/id/215801 url

Open in Interactive Console →