CVE-2026-82673: Path traversal in AshAdmin file uploads via unsanitized client filename
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.join([tmpdir, entry.clientname]) and writes it with File.cp!/2. entry.clientname is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ashadmin: from 0.13.7 before 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_adminto a version that resolves this vulnerability.Fixed in 1.3.1 - Configuration
In consume_file_uploads/1, strip path components from the browser-supplied filename by using Path.basename/1 before joining with tmp_dir (instead of Path.join([tmp_dir, entry.client_name])) to prevent path traversal/escape from the temp directory.
AshAdmin.Components.Resource.Form (consume_file_uploads/1) Destination path construction (use Path.basename/1) = Path.join([tmp_dir, Path.basename(entry.client_name)]) - Configuration
Ensure the file upload extension allowlist does not default to :any; restrict uploads to only the required extensions, since the only described guard is currently an extension allowlist.
AshAdmin file upload extension allowlist Allowed extensions = not :any (configure an extension allowlist instead of allowing all)
Event History
Frequently Asked Questions
Which deployments are exposed?
AshAdmin versions from 0.13.7 before 1.3.1 are affected where file uploads are processed through AshAdmin.Components.Resource.Form.consume_file_uploads/1. The default extension allowlist is :any, so default configuration does not restrict upload extensions.
What does an attacker need to exploit this?
An attacker needs to submit a file upload with a browser-supplied filename containing path traversal components, such as ../../. The resulting write is limited by the filesystem permissions of the BEAM process user.
What is the practical impact of successful exploitation?
Successful exploitation lets an attacker write attacker-controlled bytes outside the intended temporary upload directory to paths writable by the BEAM user. This may allow overwriting application assets, configuration, cron files, or SSH files, and can potentially lead to remote code execution.
What mitigation is available if upgrading is not immediately possible?
Sanitize the client filename by stripping path components with Path.basename/1 before constructing the destination path. Restricting extensions alone is not sufficient because the allowlist checks only the filename extension.