CVE-2026-48129 describes a path traversal vulnerability (CWE-22) in Kestra's inputFiles task prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43. The vulnerability arises because inputFiles writes rendered file names directly under the task working directory without properly restricting pathname traversal. An attacker controlling execution or webhook data can inject '../' path segments to escape the working directory and create or overwrite arbitrary files on the worker filesystem. This can lead to integrity impact by unauthorized file modification. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The issue is fixed in the specified patched versions.

The vulnerability allows an unauthenticated attacker to perform path traversal via crafted file names in the inputFiles task, potentially creating or overwriting files outside the intended directory on the worker filesystem. This can lead to unauthorized modification of files, impacting system integrity. There is no confidentiality or availability impact reported. The attack complexity is high, and no privileges or user interaction are required.

Upgrade Kestra to version 1.3.19, 1.2.19, 1.1.19, or 1.0.43 or later, where this path traversal vulnerability is patched. No other mitigation guidance is provided. Patch status is confirmed by the version information in the advisory.