Home

Description

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

PUBLISHED Reserved 2026-06-10 | Published 2026-06-11 | Updated 2026-06-11 | Assigner VulnCheck




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
affected

Any version before 0.5.1159
affected

Credits

Katriel Moses finder

VulnCheck finder

References

github.com/.../perry/security/advisories/GHSA-x55v-q459-68ch exploit

github.com/PerryTS/perry/releases/tag/v0.5.1159 release-notes

github.com/.../perry/security/advisories/GHSA-x55v-q459-68ch vendor-advisory

github.com/PerryTS/perry/pull/4989 issue-tracking

github.com/...ommit/95e1043df8081f67038bffce847dd9ddb3dae046 patch

www.vulncheck.com/...h-traversal-via-artifactready-websocket third-party-advisory

cve.org (CVE-2026-53777)

nvd.nist.gov (CVE-2026-53777)

Download JSON