CVE-2026-53777

· HIGHDeferred

← All CVEs

CVSS v3.1

8.1

CVSS v4.0

8.6

EPSS

0.38%

Published

Jun 11, 2026

Modified

Jun 11, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-22

References (6)

https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046

https://github.com/PerryTS/perry/pull/4989

https://github.com/PerryTS/perry/releases/tag/v0.5.1159

https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch

https://www.vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket

https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch

KEV Catalog EPSS Scores Vendors All CVEs