CVE-2026-85409
Received Received - Intake

Path Traversal in Eleveo Quality Management

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file_name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85409
EUVD
EUVD-2026-70889

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eleveo quality_management 9.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in Eleveo Quality Management 9.7.0. It exists in the QuestionnaireService.runDataExportNow function of the Questionnaire Service component. The flaw allows manipulation of the file_name argument, enabling unauthorized access to files outside intended directories. The attack can be executed remotely and an exploit is publicly available.

Detection Guidance

This vulnerability involves path traversal via the QuestionnaireService.runDataExportNow function in Eleveo Quality Management 9.7.0. To detect it, inspect network traffic for suspicious file_name parameters in requests to the Questionnaire Service endpoint. Check server logs for unusual file access patterns or attempts to traverse directories. Validate input handling in the application for proper sanitization of file_name arguments.

Impact Analysis

This vulnerability could allow attackers to access sensitive files on the server, potentially leading to data leaks or unauthorized modifications. If exploited, it may compromise confidential information stored in the system, depending on the permissions of the affected service.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches caused by this flaw.

Mitigation Strategies

Immediately update Eleveo Quality Management to the latest patched version if available. If no patch exists, restrict network access to the Questionnaire Service component and disable remote execution of data exports. Monitor for unusual file access patterns or path traversal attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart