An authenticated remote attacker who possesses specific permissions can craft requests or upload specially crafted files to the Network Provisioning Image Repository, enabling them to read or write files on the platform filesystem outside of the intended access boundaries. This flaw effectively allows the attacker to compromise data confidentiality by accessing unauthorized files and data integrity by altering or deleting critical configuration or system files. Over the course of the vulnerability, an attacker could increase their privileges on the device, expose sensitive information, or facilitate further exploits.

Arista Networks’ CloudVision Portal is affected. The vulnerability applies to all releases prior to the fixed versions listed by Arista: 2026.2.1 and later within the 2026.2.x train, 2026.1.3 and later within the 2026.1.x train, and 2025.3.4 and later within the 2025.3.x train. Users running older builds of the CloudVision Portal are therefore at risk. The CVE does not specify additional affected products beyond CloudVision Portal.

The CVSS score of 8.6 indicates high severity, but the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly known exploits are not documented. The likely attack vector requires the attacker to be authenticated with sufficient permissions to interact with the provisioning image repository; uncontrolled user credentials or overly permissive roles would be required to exploit the flaw. Once the attacker provides a crafted request or file, the path traversal constraint in the application allows access beyond the intended directory, leading to potential unauthorized data disclosure and modification.