Threat Intelligence Database

CVE-2026-82673 is a path traversal vulnerability in ash-project's ash_admin component that allows an attacker to write files to arbitrary paths on the server. The vulnerability arises because the filename supplied by the browser is not sanitized before being joined with a temporary directory path, enabling directory traversal. This can lead to arbitrary file writes and potentially remote code execution by overwriting critical application or system files. The issue affects versions from 0.13.7 up to but not including 1.3.1. The vulnerability has a high severity score of 8.3 CVSS 4.0.

CVE-2026-81853 is an authorization bypass vulnerability in ash-project's ash_admin component. It arises from improper validation of user-controlled keys in the decode_primary_key/2 function, allowing attackers to manipulate record lookup filters with arbitrary attributes. This can enable brute-force guessing of sensitive attribute values such as API tokens. The vulnerability affects versions from 0.1.0 up to but not including 1.3.1. The issue has a low CVSS score of 2.3 and no known exploits in the wild.

CVE-2026-81852 is a vulnerability in ash-project's ash_admin component where a hardcoded, publicly known Content-Security-Policy (CSP) nonce is used. This nonce is a compile-time constant that is not rotated per request, allowing an attacker who can inject HTML on an admin page to reuse the known nonce to bypass CSP protections against inline scripts. The issue affects versions from 0.10.8 up to but not including 1.3.1. The vulnerability has a low severity score and no known exploits in the wild.

CVE-2026-82681 is an improper encoding or escaping of output vulnerability in ash-project's ash_admin component. It allows an attacker controlling a record's string primary key to manipulate row-action URLs by injecting crafted query parameters. This occurs because the primary key and other parameters are interpolated into URLs without URL-encoding, enabling parameter injection that can alter the intended action of links. The vulnerability affects versions from 0.3.0-rc.0 before 1.3.1 of ash_admin.

CVE-2026-77850 is a stored Cross-site Scripting (XSS) vulnerability in the ash-project ash_admin component. It arises from improper neutralization of input during web page generation, specifically in relationship typeahead components that render database content without proper escaping. This allows attacker-supplied content to execute as script in an administrator's browser. The vulnerability affects versions from 0.13.0 up to but not including 1.3.1.

CVE-2026-82722 is a high-severity vulnerability in ash-project's ash_admin component that allows any client able to reach the admin LiveView to exhaust the BEAM atom table and crash the entire Erlang VM node. The issue arises because two LiveView event handlers intern atoms from unvalidated client input, which leads to unbounded atom creation. Since atoms are not garbage collected and the atom table has a fixed size, flooding these handlers with random input causes the VM to abort. This vulnerability affects ash_admin versions from 0.1.0 up to but not including 1.3.1.

CVE-2026-75757 is a high-severity vulnerability in ash-project's ash_admin component affecting versions from 0.9.1 up to but not including 1.3.1. The issue arises from reliance on cookies without proper validation and integrity checking, allowing an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. This occurs because the client JavaScript matches cookie names using an unanchored regular expression, enabling shadowing cookies from sibling subdomains to interfere with session parameters. The vulnerability is classified under CWE-565.