CVE-2026-82673 in ash_admin
Summary
by MITRE • 08/31/2026
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified as a Path Traversal flaw within the ash-admin library stems from an improper limitation of pathname restrictions to a designated secure directory, specifically classified under CWE-22 in industry standards. This security defect resides in the AshAdmin.Components.Resource.Form.consume_file_uploads function, which is responsible for handling file uploads submitted by users through web forms. The core technical failure occurs during the construction of the destination path where the system utilizes Path.join to combine a temporary directory with the client-supplied filename provided as entry.client_name. Crucially, this input is not sanitized or validated against traversal sequences before being processed. Because the Path.join function does not automatically normalize paths by removing relative navigation components such as dot-dot-slash sequences, an attacker can craft a malicious filename that escapes the intended temporary storage location and writes data to arbitrary locations on the server file system where the BEAM virtual machine user has write permissions.
The operational impact of this vulnerability is severe because it enables arbitrary file write capabilities which can be leveraged for remote code execution or significant service disruption. By uploading files with names containing sequences like ../../../../var/www/app/priv/static/x.png, an attacker can overwrite critical application assets, configuration files, or even system-level files such as cron jobs or SSH authorized keys. This capability bypasses the intended isolation of user uploads and allows for persistent backdoors or denial-of-service conditions by corrupting essential application resources. The existing security controls are insufficient because they rely solely on a file extension allowlist that defaults to accepting any extension, providing no protection against path manipulation attacks.
This vulnerability is associated with MITRE ATT&CK technique T1048 which covers Exfiltration Over Alternative Protocol and more broadly aligns with the broader category of Unrestricted File Upload leading to Remote Code Execution as described in CWE-434. The lack of input validation on the filename component represents a classic failure in secure coding practices where trust is placed in client-side data without rigorous server-side sanitization. Attackers can exploit this flaw by simply renaming their payload files during upload, effectively bypassing any superficial checks that do not account for directory traversal characters embedded within the name string itself.
The issue affects versions of ash-admin from 0.13.7 up to but not including version 1.3.1. The recommended mitigation involves updating the library to a patched version where the fix explicitly strips path components using Path.basename before joining them with the target directory. This ensures that only the final filename component is used, effectively neutralizing any attempt to traverse parent directories. Organizations relying on this framework should prioritize upgrading immediately and implement additional controls such as strict file extension validation combined with content-type verification to further reduce the attack surface associated with file upload functionalities.