CVE-2026-53777
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A path traversal vulnerability in Perry before 0.5.1159 allows a malicious build server to write arbitrary content to any location writable by the client process. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields in ArtifactReady WebSocket messages.
Risk Assessment
The organization risks overwriting sensitive files, potentially leading to system integrity compromise or privilege escalation. Additionally, local files may be exposed to attacker-accessible locations.
Recommendation
Immediately update Perry to version 0.5.1159 or later. Until updated, restrict trust to build servers and monitor WebSocket messages for suspicious paths.
Original NVD description (English source)
Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.