CVE-2026-90445

Received Received - Intake

Path Traversal in File Upload Extraction Process

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90445

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability involves a file upload feature that extracts archive contents without checking if extracted files stay within the intended directory. An attacker can create an archive that writes files to arbitrary locations using the application's privileges. This could allow tampering with system data or configuration.

Detection Guidance

Check for unexpected file writes outside intended directories by monitoring extraction processes. Look for logs or alerts from file integrity monitoring tools. Review uploaded archives for path traversal sequences like '../' in filenames. Use commands like 'find / -type f -newer /tmp/marker' to detect recent unexpected file changes.

Impact Analysis

An attacker could inject fake records into stored data or modify application settings. This might lead to data corruption, unauthorized access, or system misconfiguration, depending on the application's role and privileges.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data modification or access. GDPR and HIPAA mandate data integrity and protection; such tampering risks breaches or non-compliance, potentially leading to legal or financial penalties.

Mitigation Strategies

Disable file upload features if not essential. Implement strict path validation to prevent directory traversal. Use sandboxed environments for archive extraction. Apply least-privilege permissions to the extraction process. Monitor for unusual file writes or system changes.

Hi! I’m here to help you understand CVE-2026-90445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70