---
title: "CVE-2026-53476: Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution"
url: https://erroneo.us/security/cve/CVE-2026-53476/
description: "CVE-2026-53476 (github.com/kubev2v/assisted-migration-agent (Go)): A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-10
date_modified: 2026-08-14
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-53476"
kev: false
cvss: 9.6
epss: 0.00427
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-53476: Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.4% , percentile 36: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 36% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes github.com/kubev2v/assisted-migration-agent (Go) < 0.16.0, fixed in 0.16.0 . Check your lockfile, including transitive dependencies.

## What it is

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

## Affected packages

- Go `github.com/kubev2v/assisted-migration-agent` < 0.16.0 → fixed: 0.16.0

## Affected products (CVE record)

-  assisted-migration-agent: < bcae0438ad8386321a300413d71c982a11b7b5b7

## Severity

- redhat CVSS 3.1: 9.6 `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.43% probability of exploitation activity in the next 30 days; percentile 36.

## Sources

- [GitHub Advisory GHSA-7j4w-x8x8-5mvg](https://github.com/advisories/GHSA-7j4w-x8x8-5mvg)
- [CVE.org record CVE-2026-53476](https://www.cve.org/CVERecord?id=CVE-2026-53476)
- [NVD entry CVE-2026-53476](https://nvd.nist.gov/vuln/detail/CVE-2026-53476)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-53476)
- [RHBZ#2487233](https://bugzilla.redhat.com/show_bug.cgi?id=2487233)
- [github.com](https://github.com/kubev2v/assisted-migration-agent/pull/256)
- [github.com](https://github.com/kubev2v/assisted-migration-agent/commit/bcae0438ad8386321a300413d71c982a11b7b5b7)

---
Source page: https://erroneo.us/security/cve/CVE-2026-53476/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt