CVE-2026-82673: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in ash-project ash_admin

The vulnerability in ash_admin occurs in the function AshAdmin.Components.Resource.Form.consume_file_uploads/1, which constructs a destination path by joining a temporary directory with the client-supplied filename without normalizing or sanitizing it. This allows an attacker to use path traversal sequences (e.g., ../../../../) in the filename to escape the intended directory and write files anywhere the BEAM user has write permissions. The only existing check is an extension allowlist that does not prevent path traversal. This flaw enables arbitrary file writes and may lead to remote code execution by overwriting application assets, configuration files, or cron/ssh files. The vulnerability affects versions from 0.13.7 before 1.3.1. The fix involves stripping path components using Path.basename/1 before joining paths.

An attacker can write arbitrary files to locations on the server where the BEAM user has write access, potentially overwriting critical application assets, configuration files, or system files such as cron or ssh configurations. This can lead to remote code execution or persistent compromise of the affected system. The vulnerability has a high severity rating (CVSS 8.3) due to its network attack vector, low attack complexity, and high impact on integrity and system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known fix involves sanitizing the filename by stripping path components with Path.basename/1 before joining paths to prevent directory traversal. Until an official fix is available, avoid using affected versions or implement input sanitization to restrict file paths. Monitor vendor channels for an official patch or update to ash_admin version 1.3.1 or later, which presumably includes the fix.