CVE-2026-53476

Katalog CVE

CVSS 9.6 · Critical EPSS 0,43%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada kubev2v assisted migration agent. Skor CVSS 3.1 9.6 (Critical) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber redhat.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kubev2v/assisted-migration-agent/pull/256 patch
• https://access.redhat.com/security/cve/CVE-2026-53476 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2487233 issue tracking · advisory pihak ketiga