Kestra, an open-source event-driven orchestration platform, has a path traversal vulnerability (CWE-22) in versions before 1.0.43 and 1.3.19. Several API endpoints accept a kestra:// URI and pass it through a pathname validation function (StorageInterface.parentTraversalGuard) that only inspects the literal URI string without decoding URL-encoded characters. This allows URL-encoded '..' sequences (%2E%2E) to bypass the guard. The downstream code decodes these sequences and passes the resulting path to the OS without normalization, enabling traversal outside the intended directory. An authenticated user can exploit this to read any file the Kestra process can access, such as /etc/passwd or other sensitive files. The vulnerability is fixed in versions 1.0.43 and 1.3.19.

An authenticated user with limited privileges can exploit this vulnerability to read arbitrary files on the host filesystem that the Kestra process has access to. This can lead to disclosure of sensitive information such as system files, secrets, or data belonging to other tenants. The vulnerability does not allow code execution or modification of data but results in a confidentiality breach.

Upgrade Kestra to version 1.0.43 or later, or 1.3.19 or later, where this path traversal vulnerability has been fixed. No other mitigation is indicated or required as the fix addresses the root cause by properly handling URL-encoded path traversal sequences.