CVE-2026-101155: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Arista Networks CloudVision Portal

This vulnerability (CWE-22) in Arista Networks CloudVision Portal allows an authenticated attacker with certain permissions to perform path traversal attacks. By sending specially crafted requests or uploading malicious files to the Software Management Studio Software Repository, the attacker can access or modify files beyond the intended directory restrictions on the platform filesystem. The vulnerability affects versions >=2024.2.0 <2025.3.0, >=2025.3.0 <=2025.3.3, >=2026.1.0 <=2026.1.2, and =2026.2.0. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker with specific permissions to read or write arbitrary files on the CloudVision Portal filesystem beyond intended restrictions. This can lead to full compromise of system confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch availability. Until an official fix is released, restrict permissions to trusted users only and monitor for suspicious activity related to file uploads and software repository access.