Path Traversal Vulnerability in ash_admin by Ash Project

CVE-2026-82673

What is CVE-2026-82673?

The ash_admin component in the Ash Project is susceptible to a Path Traversal vulnerability, allowing attackers to write malicious data to arbitrary server paths. This issue arises due to improper handling of user-supplied filenames during file uploads, specifically within the consume_file_uploads function. The lack of sanitization permits crafted filenames to escape designated temporary directories, leading to arbitrary file write capabilities. This can potentially enable remote code execution by overwriting critical assets or configuration files. To mitigate the risk, it is essential to apply the provided patch that sanitizes the filename before processing.

References