PT-2026-48673 · Perryts · Perry

Katriel Moses + 1 · Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-53777

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact name or download path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-53777

Affected Products

Perry

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-53777 · Security Note
• https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch · Vendor Advisory
• https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046 · Patch
• https://github.com/PerryTS/perry/releases/tag/v0.5.1159 · Note
• https://github.com/PerryTS/perry/pull/4989 · Note
• https://vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket · Note