CVE-2026-82673

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82673
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82673.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82673
Aliases
Published
2026-08-31T02:33:10.967Z
Modified
2026-09-01T03:46:36.729619534Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
Summary
Path traversal in AshAdmin file uploads via unsanitized client filename
Details

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.

AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.join([tmpdir, entry.clientname]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.

This issue affects ash_admin: from 0.13.7 before 1.3.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82673.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "e8f496b6a064ad67dc1cd30433e5921d2192d254"
                },
                {
                    "fixed": "4bb41cb697f3d9be58462d727aed75aba76efc82"
                }
            ]
        }
    ],
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/ash-project/ash_admin

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_admin
Events
Introduced
7aa874db1ec715ed43c167aa7eedbcaf3fd7a4ab
Fixed
91da87c1c23cd6199ba1b0a1c8849a4c605130cc
Fixed
4bb41cb697f3d9be58462d727aed75aba76efc82
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.13.7"
        },
        {
            "fixed": "1.3.1"
        }
    ]
}

Affected versions

v0.*
v0.13.10
v0.13.11
v0.13.12
v0.13.13
v0.13.14
v0.13.15
v0.13.16
v0.13.17
v0.13.18
v0.13.19
v0.13.20
v0.13.21
v0.13.22
v0.13.23
v0.13.24
v0.13.25
v0.13.26
v0.13.7
v0.13.8
v0.13.9
v0.14.0
v1.*
v1.1.0
v1.2.0
v1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82673.json"