CVE-2026-53476CWE-59

Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write

Critical · published June 10, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00427 · 36.0th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-06-10T13:55Z
EPSS history
Timeline
  • 10 JUN 13:55Z
    Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write
    cvelistv5