Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server.

AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.join([tmpdir, entry.clientname]) and writes it with File.cp!/2. entry.clientname is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.

This issue affects ashadmin: from 0.13.7 before 1.3.1.

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes.

AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{apitoken: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.tolist/1 also accepts structs, yielding a bogus struct key. The fix rejects any decoded key that is not a real primary-key field.

This issue affects ashadmin: from 0.1.0 before 1.3.1.

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashadmin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.

Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's setactor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.toatom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.

This issue affects ashadmin: from 0.1.0 before 1.3.1.