Skip to content
OpenAdvisories

Vendor

treeverse

7 known vulnerabilities.

Products

lakeFS 7 lakeFS-enterprise 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-48026

    lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

    lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing…

    treeverse lakeFS lakeFS-enterprise
  • High 8.1
    CVE-2026-26187

    lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

    lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. Th…

    treeverse lakeFS github.com/treeverse/lakefs Go