The vulnerability in assisted‑migration‑agent enables an unauthenticated attacker on the same local area network to craft a specially designed gzipped tarball that bypasses security checks. By exploiting a path‑traversal flaw, the attacker can write arbitrary files to the system, effectively allowing execution of unauthorized code. This flaw corresponds to CWE‑59 and CWE‑22 and carries a CVSS score of 9.6, indicating critical severity.

Products affected are instances of the assisted‑migration‑agent software distributed by kubev2v. No specific version information is provided in the advisory, so the vulnerability may exist in all releases prior to the fix.

The CVSS score of 9.6 signals a very high risk of successful exploitation. EPSS data, indicating a very low exploitation probability (less than 1%), is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local network traffic directed at the agent, as the attacker must be able to deliver a crafted tarball over the LAN. If exploited, the attacker could overwrite critical configuration or binary files and achieve remote code execution on the appliance. This flaw corresponds to CWE‑59 and CWE‑22.