Path Traversal in Ivanti Xtraction

Executive Summary

This is a Path Traversal vulnerability in Ivanti Xtraction software versions before 2026.4. It allows a remote attacker who is already authenticated to create or modify directories on the host file system outside the intended application directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate file system directories to store malicious files, overwrite existing files, or disrupt normal application operations. This could lead to data corruption, unauthorized file access, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data through directory traversal. Remote authenticated attackers might access or modify files outside intended directories, risking data breaches or unauthorized disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Update Ivanti Xtraction to version 2026.4 or later to address the Path Traversal vulnerability. Ensure only trusted users have authenticated access to the system.

Useful 0 Not Useful 0