This vulnerability involves external control of file names or paths (CWE-73) in Ivanti Xtraction versions prior to 2026.2. An authenticated remote attacker can exploit this to read sensitive files on the system and write arbitrary HTML files into a web-accessible directory. This can lead to significant information disclosure and enable client-side attacks such as cross-site scripting or phishing. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation allows an authenticated remote attacker to read sensitive files and write arbitrary HTML files to a web directory. This results in information disclosure and may facilitate client-side attacks against users accessing the affected web content. The vulnerability severely compromises confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on Ivanti releasing and distributing an official fix. Until a patch is available, restrict authenticated user permissions to limit file access and web directory write capabilities where possible.