Ivanti Xtraction CVE-2026-106034

Exploitation requires a valid authenticated Xtraction account (PR:L) with access to the feature that performs directory creation/modification; the attacker supplies path-traversal input to escape the intended directory and write to arbitrary locations on the host filesystem. Limiting factors: the attacker must first obtain valid credentials (no anonymous access), and impact is confined to integrity (directory creation/modification) with no direct confidentiality or availability effect per the CVSS vector. Affected deployments are Ivanti Xtraction instances before version 2026.4; upgrading to 2026.4 removes the condition.

This is a moderate-severity path traversal (CWE-22) in Ivanti Xtraction with a vendor CVSS of 5.0. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N indicates a network-exploitable, low-complexity flaw that requires authentication (PR:L) and no user interaction, with a changed scope (S:C) but only a limited integrity impact (I:L) and no confidentiality or availability impact. The signals are internally consistent: the description's 'remote authenticated attacker' matches PR:L, and 'create, modify arbitrary directories' matches the integrity-only impact with C:N/A:N. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. The authentication requirement and integrity-only impact place this well below a drop-everything priority; it is a genuine but bounded issue most relevant where untrusted or low-privilege users hold Xtraction accounts. The scope change (S:C) is the one factor that elevates concern, as filesystem writes reach the host beyond the application boundary and could, in principle, be chained toward more serious outcomes. Treat as a patch-in-normal-cycle item unless Xtraction is internet-exposed with broad authenticated access.

A low-privileged but authenticated Xtraction user sends a crafted request containing directory-traversal sequences (e.g., ../) in a parameter that controls a directory operation, causing the application to create or modify directories at arbitrary locations on the host filesystem outside the intended application path. No public exploit code was identified in the provided data, and exploitation requires valid credentials and low attack complexity (AC:L) but no user interaction.