CVE-2026-101154: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Arista Networks CloudVision Portal

CVE-2026-101154 is a CWE-22 path traversal vulnerability in Arista Networks CloudVision Portal. An authenticated attacker with certain permissions can exploit this flaw by sending crafted requests or uploading files to the Network Provisioning Image Repository, enabling unauthorized read or write access to the platform filesystem beyond the intended restricted directories. This could lead to compromise of sensitive data, modification of critical files, or disruption of service. The vulnerability affects versions >=2018.1.0 <2025.3.0, >=2025.3.0 <=2025.3.3, >=2026.1.0 <=2026.1.2, and =2026.2.0. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker with specific permissions to read or write arbitrary files on the CloudVision Portal filesystem outside the intended restricted directories. This can lead to unauthorized disclosure of sensitive information, unauthorized modification or deletion of files, and potential disruption of the platform's normal operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Arista Networks' advisories for updates. In the meantime, restrict permissions to only trusted users and closely control access to the Network Provisioning Image Repository to limit exposure.