CVE-2026-53777

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
PerryTS	perry	< 0.5.1159

References

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-537797.5WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside CVE-2026-53786.8An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an CVE-2026-537814.3Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media CVE-2026-537827.4Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct CVE-2026-537838.1rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that CVE-2026-537847.1rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when CVE-2026-537857.1rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination di CVE-2026-537866.5rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restriction CVE-2026-537879.8Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unaut CVE-2026-537886.5rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to CVE-2026-537898.1rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operation CVE-2026-53793.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. Th