Kestra, an open-source event-driven orchestration platform, has a path traversal vulnerability (CWE-22) in its task inputFiles feature. Before versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, the platform writes rendered file names directly under the task working directory without properly sanitizing input. This allows an attacker who can influence file names (e.g., via untrusted execution or webhook data) to use '../' path segments to escape the working directory and create or overwrite arbitrary files on the worker filesystem. The issue is addressed in the specified patched versions.

An attacker able to control the inputFiles file name can overwrite or create files outside the intended directory on the worker filesystem, potentially leading to unauthorized modification of files. The CVSS score of 6.5 (medium severity) reflects that the vulnerability requires network access with high attack complexity and no privileges or user interaction, causing integrity impact and low availability impact but no confidentiality impact.

Upgrade Kestra to version 1.3.19, 1.2.19, 1.1.19, or 1.0.43 or later, where the path traversal vulnerability has been patched. No other mitigation guidance is provided; patching is the recommended remediation.