| Titolo | Eleveo Quality Management 9.7.0 Arbitrary File Write |
|---|
| Descrizione | An Arbitrary File Write vulnerability exists in the QuestionnaireService.runDataExportNow GWT RPC method of Eleveo Quality Management 9.7.0, allowing authenticated users to write files to arbitrary locations on the server filesystem. The application accepts a user-supplied file name and incorporates it into the file path without proper validation, allowing the use of path traversal sequences to escape the intended export directory. Although the application enforces a limitation where the generated file is always appended with a .csv or .xlsx extension, and the attacker can only partially control the file content, it is still possible to create files in unintended directories, including web-accessible locations.
Impact
• Unauthorized file write may occur when attackers write files to arbitrary locations on the server filesystem.
• Limited content injection may occur when attackers control portions of the generated file content, which may still be leveraged for further attacks.
• Information disclosure may occur if written files are placed in web-accessible directories and retrieved by unauthorized users.
• Integrity violation may occur when files are created in unintended locations, affecting application behavior or data organization.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details. |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/1fCPpqzYyoII_lfC6iXy-hLd1YpJcgmgR/view?usp=sharing |
|---|
| Utente | omarelshopky (UID 85487) |
|---|
| Sottomissione | 18/07/2026 14:55 (2 mesi fa) |
|---|
| Moderazione | 03/09/2026 20:45 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 398559 [Eleveo Quality Management 9.7.0 Questionnaire Service QuestionnaireService.runDataExportNow file_name directory traversal] |
|---|
| Punti | 20 |
|---|