AshAdmin CVE-2026-82673

Exploitation requires a valid authenticated session in the AshAdmin interface with access to at least one resource form that includes a file upload field. The extension allowlist defaults to :any, meaning file type restrictions are absent unless explicitly configured by the application developer, so virtually any file content can be written. The BEAM OS user's filesystem write permissions define the reachable target paths; deployments where the BEAM user owns application source directories, /etc/cron.d, or ~/.ssh directly enable RCE via the write primitive. Exploitation is limited by: the requirement for valid AshAdmin authentication (PR:L per CVSS 4.0); the need to identify writable target paths relative to the server's temp directory anchor; and deployments where the BEAM user is restricted by OS-level permissions to only its own upload directory, which would confine the impact to that sandbox.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) accurately reflects a high-severity integrity-focused vulnerability requiring low-privilege authentication. PR:L is the primary real-world limiting factor - only users with access to the AshAdmin interface and a resource form containing a file upload field can exploit this. Attack complexity is genuinely low: no race condition, memory corruption, or cryptographic bypass is involved; the attacker simply crafts a malicious filename. The SI:H metric captures filesystem-level impact extending beyond the application's upload sandbox. No EPSS score was provided in the intelligence data and this CVE does not appear in CISA KEV, so no confirmed widespread exploitation is known at time of analysis. However, the path from upload access to arbitrary file write - and from there to RCE - is direct and requires no special tooling, making the severity well justified for organizations running AshAdmin where the BEAM OS user has broad write permissions.

An authenticated AshAdmin user submits a multipart file upload through any resource form, naming the file ../../../../var/www/app/priv/static/shell.ex or a similar traversal string targeting a writable server path. AshAdmin's consume_file_uploads/1 joins this unsanitized name directly to the temp directory prefix via Path.join, resolving the traversal at the OS level, and writes the attacker's file content to the target location. If the BEAM user has write access to application source directories, cron scripts, or SSH configuration, the attacker achieves remote code execution by overwriting a file that is subsequently loaded or executed by the server or OS scheduler. No public exploit code has been identified at time of analysis, but the technique requires only a browser and knowledge of likely server directory layout.