CVE-2026-53777 is a path traversal vulnerability in Perry before version 0.5.1159. The vulnerability arises because the application does not properly sanitize pathname inputs in the artifact_name and download_path fields of ArtifactReady WebSocket messages. An attacker controlling the build server URL can exploit this to write arbitrary files to any location writable by the Perry process or expose local files to an attacker-accessible location. This can lead to unauthorized file modification or disclosure.

Successful exploitation allows an attacker to overwrite sensitive files or expose arbitrary local files, potentially compromising system integrity and confidentiality. The vulnerability has a high severity with a CVSS 4.0 score of 8.6, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid trusting build servers or inputs that control artifact_name or download_path fields. Monitor for updates from the PerryTS project regarding an official fix.