GHSA-7j4w-x8x8-5mvg

Source

https://github.com/advisories/GHSA-7j4w-x8x8-5mvg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7j4w-x8x8-5mvg/GHSA-7j4w-x8x8-5mvg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7j4w-x8x8-5mvg

Aliases

CVE-2026-53476
GO-2026-6231

Published

2026-06-10T15:31:33Z

Modified

2026-08-18T15:10:32Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Details

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

Database specific

{
    "cwe_ids":  [
        "CWE-22",
        "CWE-59"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-14T19:21:11Z",
    "nvd_published_at":  "2026-06-10T15:16:42Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/kubev2v/assisted-migration-agent

Package

Name: github.com/kubev2v/assisted-migration-agent; View open source insights on deps.dev
Purl: pkg:golang/github.com/kubev2v/assisted-migration-agent

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.16.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7j4w-x8x8-5mvg/GHSA-7j4w-x8x8-5mvg.json"