Arista CloudVision Portal: Path traversal in Software Repository
Summary
An authenticated remote attacker with specific permissions can read or write files outside the intended scope on the platform filesystem of Arista CloudVision Portal. The attack uses specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository. The issue is present in the default configuration of affected releases and requires no user interaction.
Affected
- CloudVision Portal 2026.2.0
- CloudVision Portal 2026.1.0 to 2026.1.2
- CloudVision Portal 2025.3.0 to 2025.3.3
- CloudVision Portal 2024.2.0 to below 2025.3.0
- Releases before 2024.2.0: Unknown.
Fixed in
- 2026.2.1 and later in the 2026.2.x train
- 2026.1.3 and later in the 2026.1.x train
- 2025.3.4 and later in the 2025.3.x train
Workaround
- No mitigation available according to the vendor data.
Exploitation
- Not known to be exploited (CISA SSVC: Exploitation none, Automatable no, Technical Impact total).
- No public proof of concept found in the research.
Our recommendation
- Upgrade CloudVision Portal to the fixed releases listed above.
- Confirm the affected version range against the Arista advisory before acting.
- Restrict access to the CloudVision management interface to administrative networks and verify it is not reachable from the internet.
- Limit accounts that hold repository and upload permissions.
- Patch related Arista advisories published the same day, such as CVE-2026-101154, in the same cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0189 www.arista.com
- OpenCVE CVE-2026-101155 app.opencve.io
- HOL Guard CVE-2026-101155 hol.org
- Strix CVE-2026-101155 www.strix.ai
- Vulners ARISTA:0189 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:16.
Original description (NVD)
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.