lakeFS vulnerabilities

2 known vulnerabilities in lakeFS from Treeverse. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  lakeFS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-48026Aug 7, 2026Treeverse

  lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing

• 8.1 High severity

  lakeFS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-26187Feb 13, 2026Treeverse

  lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The