CVE-2026-48544 is a path traversal vulnerability in Avaiga's Taipy 4.1.1, specifically in the ElementLibrary.get_resource() method located in taipy/gui/extension/library.py. The vulnerability arises from an incomplete path containment check that uses str.startswith() without a trailing path separator, allowing attackers to craft GET requests with path traversal sequences that bypass the directory restriction. Flask's path converter and Werkzeug's WSGI layer preserve these traversal segments, causing the flawed startswith check to incorrectly validate paths that actually point outside the intended directory. This enables unauthorized file access outside the module directory.

An unauthenticated attacker can exploit this vulnerability to access files outside the intended restricted directory, potentially exposing sensitive information or system files. The vulnerability has a high severity score (CVSS 8.7) due to its network exploitable nature without any required privileges or user interaction and the high impact on confidentiality.

A fix for this vulnerability is available and was introduced after version 4.1.1 in commit 129fd40. Users should upgrade to a version that includes this fix to prevent exploitation. Until patched, avoid exposing the vulnerable endpoint to untrusted networks or users.