CVE-2026-67200 is a path traversal vulnerability in perspective-dev's Perspective product, affecting versions up to and including 5.0.0. The flaw allows unauthenticated remote attackers to bypass inadequate query-string sanitization by including literal ../ segments in HTTP request URL paths, enabling them to access arbitrary files outside the configured asset root directory. The vulnerability is compounded by a wildcard Access-Control-Allow-Origin header, which exposes the retrieved sensitive file contents cross-origin. This vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server filesystem, including sensitive system credentials and application secrets. The wildcard Access-Control-Allow-Origin header increases the risk by exposing these files to cross-origin requests, potentially enabling attackers to steal sensitive information via client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Perspective server and monitor for suspicious requests attempting path traversal patterns. Consider disabling or restricting the Access-Control-Allow-Origin header to prevent cross-origin data exposure.