CVE-2026-82673

Name of the Vulnerable Software and Affected Versions ash admin versions 0.13.7 through 1.3.0

Description A path traversal issue exists where the software fails to properly limit pathnames to a restricted directory, allowing the writing of attacker-controlled bytes to arbitrary paths on the server. The function consume file uploads/1 within AshAdmin.Components.Resource.Form constructs the destination path using Path.join([tmp dir, entry.client name]) and writes it via File.cp!/2. Because the entry.client name variable is supplied by the browser and not sanitized, and Path.join/1 does not normalize the path, an attacker can use sequences like ../../ to escape the temporary directory. This enables arbitrary file writes to any location accessible by the BEAM user, which could lead to remote code execution by overwriting application assets, configuration files, or system files such as cron or ssh files.

Recommendations Update ash admin to version 1.3.1 or later.