CVE-2026-48544 describes a path traversal vulnerability in Avaiga taipy 4.1.1 within the ElementLibrary.get_resource() method (taipy/gui/extension/library.py). The vulnerability stems from an incomplete path containment check that uses str.startswith() without a trailing path separator, allowing crafted GET requests with path traversal sequences to escape the intended module directory. Flask's and Werkzeug's handling of path segments preserves traversal sequences, which bypass the flawed startswith check, enabling unauthorized file access outside the library directory. The issue is fixed in commit 129fd40, but no official patch release or advisory details are currently available.

An unauthenticated attacker can exploit this vulnerability to access files outside the intended restricted directory, potentially exposing sensitive information or configuration files. The CVSS 4.0 score of 8.7 indicates a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. There is no indication of known exploits in the wild at this time.

A fix is available in the codebase as of commit 129fd40. However, no official patch release or vendor advisory has been published yet. Users should apply the fix from the referenced commit or monitor the vendor's channels for an official patch. Until then, consider restricting access to the affected endpoint or implementing additional access controls to mitigate unauthorized file access.