PT-2026-48673 · Perry · Perry

Katriel Moses + 1 · CVE-2026-53777 · Published 2026-06-11 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Perry versions prior to 0.5.1159

Description A path traversal issue exists where a malicious build server can write arbitrary content to any location writable by the running process. This occurs when unsanitized path components are supplied in the artifact name field of ArtifactReady WebSocket messages. Attackers who control the server URL can deliver traversal payloads through the artifact name or download path fields, leading to the overwriting of sensitive files or the exposure of arbitrary local files to a location accessible by the attacker.

Recommendations Update to version 0.5.1159 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-53777

GHSA-X55V-Q459-68CH

Affected Products

Perry

References · 11

• 🔥 https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53777.json · Exploit
• https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-53777 · Security Note
• https://osv.dev/vulnerability/CVE-2026-53777 · Vendor Advisory
• https://github.com/PerryTS/perry/pull/4989 · Note
• https://github.com/PerryTS/perry/releases/tag/v0.5.1159 · Note
• https://github.com/PerryTS/perry · Note
• https://t.me/CVEtracker/56607 · Telegram Post
• https://t.me/cveNotify/167133 · Telegram Post
• https://vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket · Note