EUVD-2026-82851
GHSA-g8rr-pmrr-phx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AppScan 360° as low-priv user
-
ExploitSubmit crafted path to ASReportService
-
ExecutionTraverse outside intended directory
-
ImpactRead or overwrite in-scope application files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on HCLSoftware AppScan 360° (PR:L) with access to the ASReportService component; the attacker then supplies manipulated file-path input that the component fails to sanitize. Exploitation is LIMITED by the authentication requirement and by the traversal being bounded to the application's own directory scope rather than the entire host filesystem, which constrains both what can be read and what can be overwritten. No user interaction is needed, and the vector is network-reachable against the application's authenticated interface. |
| Impact | This is a moderate-severity, authenticated flaw whose real-world risk sits well below its 6.3 base score. The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) requires prior authenticated access (PR:L) and caps every impact dimension at Low, because the traversal is bounded to the application's own directory scope rather than the full filesystem - so it is neither a root-level file read nor an arbitrary system-wide write. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. There is no signal conflict to reconcile - the network vector, low complexity, and required privilege level are internally consistent with the description. The main caveats are inferred, not confirmed: the phrase 'within the application's directory scope' constrains impact, but the exact directory boundary and whether the write primitive could reach executable/config files (which would raise integrity impact) are not verifiable from the single sparse KB reference. Overall this is a legitimate but low-priority defense-in-depth fix for an authenticated user of a niche security-testing product, not an urgent internet-facing threat. |
| Exploit ScenarioDerived | An attacker who already holds valid AppScan 360° credentials sends a crafted request to the ASReportService component containing directory-traversal sequences in a file-path parameter, causing the service to read a sensitive file or overwrite a file outside the intended reporting directory but still within the application's directory scope. No public exploit code is currently identified, and low attack complexity means a successful path-traversal payload requires no special timing or environmental conditions once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Path traversal in the ASReportService component of HCL AppScan 360° allows an authenticated user to supply manipulated file-path input and reach files outside the intended report directory, exposing the surrounding file-system structure or permitting modification of files within the application's directory scope. The flaw is network-reachable but requires a valid account and access to the ASReportService interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which keeps practical risk moderate and well below the 6.3 base score. There is no public exploit identified at time of analysis and no confirmed active exploitation.
RemediationAI
No patch version was specified in the available intelligence, so administrators should consult HCL's advisory KB0133460 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133460) to identify the fixed release and apply it as the primary remediation; the vendor should also be queried directly if the advisory does not yet list a fixed build. Until then, compensating controls are: strictly limit which accounts can reach the ASReportService interface, since exploitation requires authentication and reducing the pool of authenticated users directly shrinks the attack surface; run the application under a least-privilege service account whose write permissions are confined to a dedicated report/output directory so that any successful traversal cannot overwrite sensitive configuration files; and place an inline filter or WAF rule in front of the application that rejects request parameters containing traversal sequences (../, ..\, encoded variants) or absolute paths, with the trade-off that aggressive normalization rules can break legitimate report names that contain unusual characters. Because impact is limited to the application's own directory scope, isolating the AppScan 360° installation on a host that holds no other sensitive data further reduces residual risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-22 improper-limitation-of-a-pathname-to-a-restricted-directory defect in the ASReportService component of HCL AppScan 360°, HCL's application security testing platform. Report services typically accept caller-supplied paths for templates, generated reports, or output locations; when those paths are concatenated into file operations without canonicalization or a strict allow-list, sequences such as ../ let an authenticated caller escape the intended working directory. The CVSS vector (PR:L, S:U, C:L/I:L/A:L) confirms the attacker must already hold an authenticated account and that the impact is bounded: scope is unchanged, and both confidentiality and integrity effects are limited because traversal is constrained to the application's own directory scope rather than the full host file system. No authentication bypass, user interaction, or privilege escalation is involved.
Know when Hcl Appscan 360 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-reachable authenticated service (PR:L, AV:N); traversal confined to the application directory scope yields Low read, Low write, and Low availability impact rather than full compromise.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB