An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond…

Arista Networks CloudVision Portal contains a path traversal flaw (CWE-22) in the Software Management Studio Software Repository, which handles file uploads and requests. The weakness lets files outside the intended directory be accessed. An attacker with high-privilege authenticated access to the product can send specially crafted requests or uploads to read or write files on the platform filesystem beyond their intended scope, with no user interaction required and the attack reachable over the network.