A vulnerability in the Contrast CLI's Kata agent policies allowed arbitrary writes to the guest root filesystem via the CopyFile verification process. This flaw enabled a malicious host process with VSOCK access to issue CopyFile requests that could overwrite security-critical files or cause sensitive data disclosure, leading to full guest takeover. The issue is patched in Contrast version 1.19.1. Users unable to upgrade can apply a rego-based policy fix as a workaround.