CVE-2026-82673
Received Received - Intake

Path Traversal in ash_admin via Unsanitized File Upload

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining. This issue affects ash_admin: from 0.13.7 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82673
EUVD
EUVD-2026-68331

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.13.7 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82673 is a path traversal vulnerability in the AshAdmin library. It allows attackers to write arbitrary files to any location on the server by exploiting unsanitized filenames in file-upload fields. The vulnerability occurs because the code uses browser-provided filenames directly to construct file paths without validation. Attackers can craft filenames with path traversal sequences like ../../../../etc/passwd to escape intended directories and write files anywhere the server user can access.

Detection Guidance

Check for suspicious file uploads in your application's temporary directories or unexpected file writes in system directories like /var/www/app/priv/static. Review web server logs for upload requests with filenames containing path traversal sequences like ../ or ..\. Use commands like find /tmp -type f -name '*..*' to search for files with suspicious names in temp directories.

Impact Analysis

This vulnerability can lead to severe consequences such as remote code execution by overwriting critical files like application assets, configuration files, or system binaries. Attackers could replace existing files with malicious payloads, gain control over the server, or steal sensitive data. Exploitation requires only access to the admin UI form with a file-upload field.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. A successful exploit could lead to data breaches, unauthorized modifications, or system compromises, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade ash_admin to version 1.3.1 or later immediately. If upgrading is not possible, restrict write permissions on critical directories and disable file upload features in the admin UI. Monitor for unauthorized file writes and review uploaded files for malicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart