EUVD-2026-88463
GHSA-vhv2-j368-w4wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySend crafted request to Scorecard.jsp
-
ExploitInject traversal sequence in audio-upload path
-
ExecutionRead or write file outside intended directory
-
ImpactDisclose or tamper with server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a network-reachable Eleveo Quality Management 9.7.0 instance and a valid low-privilege authenticated session (CVSS PR:L) to reach the Questionnaire Audio Upload functionality served by Scorecard.jsp; exploitation is performed by supplying directory-traversal input to the audio-upload path parameter. No user interaction is needed (UI:N). Limiting factors: the attacker must first obtain authentication/access to the QM application (not exploitable pre-auth), impact is bounded to LOW confidentiality/integrity/availability (file read/write within the server's access rights, not RCE), and there is no vendor patch, so mitigation depends on network isolation, access control, and monitoring of the affected component. |
| Impact | Signals are mixed and point to a real-but-low-priority issue rather than an urgent one. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3, MEDIUM) describes a network-reachable, low-complexity path traversal that nonetheless requires some privilege (PR:L) and yields only LOW confidentiality, integrity, and availability impact - consistent with a bounded file read/write rather than full compromise or RCE. A public exploit exists (E:P in the vector; a Google Drive PoC is linked), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active or widespread exploitation. The disclosure path (VulDB submission, vendor contacted but unresponsive, no official patch) means defenders cannot rely on a vendor advisory or fix. Net: publicly available exploit code exists but exploitation is not confirmed in the wild; the low authenticated privilege requirement and low technical impact keep real-world risk modest and localized to organizations actually running Eleveo Quality Management 9.7.0. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated session on the Eleveo Quality Management web interface sends a crafted request to Scorecard.jsp abusing the Questionnaire Audio Upload handler, embedding directory-traversal sequences (e.g., ../../) in a file/path parameter to read or write files outside the intended upload directory. A public proof-of-concept has been disclosed (hosted on Google Drive), lowering the bar for reproduction. Because impact is rated low across confidentiality, integrity, and availability, realistic outcomes are limited file disclosure or unauthorized file placement rather than immediate full system takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
RemediationAI
No vendor-released patch identified at time of analysis, and Eleveo did not respond to the coordinated disclosure, so remediation currently depends on compensating controls rather than a fixed version. The highest-value control is to stop untrusted reachability: place the QM application behind a reverse proxy or firewall rule that permits only known administrator networks and corporate VPN ranges to reach Scorecard.jsp and the Questionnaire Audio Upload paths, accepting the trade-off that legitimate reviewers and agents must connect through the VPN or a jump host. Harden the runtime so traversal yields little: run the servlet container under a dedicated least-privilege service account, keep the upload directory on its own filesystem mount and make it read-only to the application process except for the exact upload path (this may break the audio-upload feature if implemented as a blanket read-only mount), and remove any unnecessary write permissions or supplied files reachable from the application root. Deploy path-canonicalization filtering at the proxy/WAF to reject requests containing ../, ..\, and encoded variants such as %2e%2e%2f or %252e, but treat this as a speed bump rather than a fix because encoding and parser discrepancies can bypass signature-based filtering. Restrict and audit accounts that can authenticate to QM, since exploitation requires a valid low-privilege session, and forward application and web server logs to a SIEM with alerts on traversal patterns in upload parameters. Track the VulDB records at https://vuldb.com/vuln/410994 and https://vuldb.com/cve/CVE-2026-101142 for any vendor fix, and press Eleveo support directly for a patch or version guidance before relying on compensating controls long term.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-22 improper limitation of a pathname to a restricted directory in a Java/JSP web application: Eleveo Quality Management 9.7.0 exposes Scorecard.jsp under the Questionnaire Audio Upload feature, which accepts an audio file together with a path or filename parameter and writes it to disk on the server. Because the supplied path is not canonicalized and validated against the permitted upload root, sequences such as ../ (including their URL-encoded equivalents) let a caller traverse outside the intended directory, giving the server-side file handling code access to locations it should never touch. The CPE string cpe:2.3:a:eleveo:quality_management:*:*:*:*:*:*:*:* records the entire Eleveo Quality Management product line as in scope, with 9.7.0 explicitly named as the tested and affected version. Exploitation is network-reachable and requires an authenticated session (CVSS PR:L), meaning an attacker must already hold valid credentials for the QM application; it is not exploitable pre-authentication, and the resulting file access is constrained by the privileges of the account the servlet container runs under, so the primitive is file read/write inside those rights rather than command execution. The CVSS 4.0 vector published with the disclosure and the independent CVSS 3.1 vector agree on a network attack path, low privileges, no user interaction, and uniformly LOW confidentiality, integrity, and availability impact.
Know when Quality Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable JSP endpoint with low complexity but requires an authenticated low-privilege session (PR:L); path traversal yields bounded low file read/write, so C/I/A all Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Quality Management
View allPath traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export di
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conve
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arb
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privileged user with network acces
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious sc
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an
Exploit-DB