---
id: CVE-2026-53777
title: Perry < 0.5.1159 Path Traversal via ArtifactReady WebSocket
summary: >-
  Perry before 0.5.1159 contains a path traversal vulnerability that allows a
  malicious build server to write arbitrary content to any location writable by
  the running process by supplying unsanitized path components in the
  artifact_name f…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: PerryTS
product: perry
affected:
  - perry < 0.5.1159
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-11T16:10:46.140905Z'
exploitAvailable: true
published: '2026-06-11'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:04.180Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53777'
references:
  - url: 'https://github.com/PerryTS/perry/releases/tag/v0.5.1159'
    label: perry 0.5.1159 Release Notes
  - url: 'https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch'
    label: GitHub Security Advisory (GHSA-x55v-q459-68ch)
  - url: 'https://github.com/PerryTS/perry/pull/4989'
  - url: >-
      https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046
  - url: >-
      https://www.vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket
tags:
  - cve.org
  - exploit-available
epss: 0.00467
epssPercentile: 0.40665
ingestedAt: '2026-11-08T14:51:22.379Z'
---

## Overview

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

## Affected

- `perry < 0.5.1159`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.