CVE-2026-53476: Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.
Published Jun 10, 2026 · Updated Aug 14, 2026
Affected packages
github.com/kubev2v/assisted-migration-agent
- Ecosystem
- Go
- Affected
- < 0.16.0
- Fixed in
- 0.16.0
- Check
go list -m github.com/kubev2v/assisted-migration-agent
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53476
- https://github.com/kubev2v/assisted-migration-agent/pull/256
- https://access.redhat.com/security/cve/CVE-2026-53476
- https://bugzilla.redhat.com/show_bug.cgi?id=2487233
- https://github.com/kubev2v/assisted-migration-agent/commit/bcae0438ad8386321a300413d71c982a11b7b5b7
- https://github.com/advisories/GHSA-7j4w-x8x8-5mvg
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology