CVE-2026-85409: Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal
A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which deployments are known to be affected?
Eleveo Quality Management version 9.7.0 is identified as affected. The available data does not establish whether other versions or default configurations are affected.
How urgent is remediation?
The issue is rated medium severity with a CVSS score of 6.3, and public exploit code is available. Prioritize systems where low-privileged remote users can reach the Questionnaire Service.
Is a vendor fix or mitigation available?
The provided information does not identify a vendor fix or workaround. It states that the vendor was contacted but did not respond.