A vulnerability was identified in Eleveo Quality Management 9.7.0. (CVE-2026-85409)

CVE-2026-85409 is a path traversal vulnerability in Eleveo Quality Management 9.7.0 affecting the QuestionnaireService.runDataExportNow function. By manipulating the file_name argument, an attacker with remote access and limited privileges can traverse directories to access files outside the intended scope. The vulnerability is publicly known, and exploit code is available, though no active exploitation in the wild has been reported. The vendor has not provided a response or patch for this issue.

Successful exploitation could allow an attacker to read or possibly write files outside the intended directory structure, potentially leading to information disclosure, data integrity issues, or denial of service. The CVSS 3.1 base score of 6.3 reflects low to moderate impact with network attack vector, low attack complexity, and no user interaction required. Privileges are required but only low-level privileges, increasing the risk compared to higher privilege requirements.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is provided, restrict access to the affected service to trusted users only and consider network-level controls to limit exposure. Avoid supplying untrusted input to the vulnerable function if possible.