EUVD-2026-68331Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable by low-privileged authenticated users; scope changes as file writes escape the upload sandbox to arbitrary server paths; integrity-only impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.
AnalysisAI
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in the AshAdmin interface with access to at least one resource form that includes a file upload field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) accurately reflects a high-severity integrity-focused vulnerability requiring low-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_admin to version 1.3.1 or later, which incorporates the fix from commit 4bb41cb697f3d9be58462d727aed75aba76efc82 (https://github.com/ash-project/ash_admin/commit/4bb41cb697f3d9be58462d727aed75aba76efc82); the vendor advisory at https://github.com/ash-project/ash_admin/security/advisories/GHSA-483p-rgcq-p5j9 confirms this as the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdo
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin in
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and st
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolatio
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today