CVE-2026-106047: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Ivanti Xtraction

This vulnerability (CWE-22) exists in Ivanti Xtraction prior to version 2026.4, where improper limitation of a pathname in the template export feature enables a remote authenticated attacker to perform path traversal attacks. This allows unauthorized reading of arbitrary files on the system. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker with valid authentication can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive information. There is no indication of integrity or availability impact. The confidentiality breach could lead to exposure of critical data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the template export functionality to trusted users and monitor for suspicious activity.