CVE-2026-53777 Details
Description
Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.
A path traversal vulnerability has been identified in Perry versions prior to 0.5.1159. This vulnerability allows a malicious build server to write arbitrary content to any location writable by the running process. The issue arises because the 'artifact_name' field in 'ArtifactReady' WebSocket messages is not properly sanitized, allowing attackers to inject traversal payloads. Additionally, the 'download_path' field can be exploited to read sensitive local files. The vulnerability can be exploited by controlling the server URL and sending crafted WebSocket messages.
Users are advised to upgrade to Perry version 0.5.1159, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046 | [email protected] | Source CodeVendor |
| https://github.com/PerryTS/perry/pull/4989 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/PerryTS/perry/releases/tag/v0.5.1159 | [email protected] | Release NotesVendor |
| https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Perry | <= 0.5.1158 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |