CVE-2026-101155CWE-22path-traversal

CVE-2026-101155

Critical · published October 7, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-07T00:17Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 06 OCT 19:38Z
    Security Advisory 0189
    cvelistv5