CVE-2026-82673

AshAdmin, the admin dashboard component for the Elixir Ash Framework, contains a path traversal flaw (CWE-22) in its file-upload handling: AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) using the browser-supplied filename without sanitization, and Path.join/1 does not normalize '..' segments. An authenticated user of the admin panel can upload a file with a crafted name such as '../../../../var/www/app/priv/static/x.png', escaping the random temp directory and writing attacker-controlled bytes to any path the BEAM process user can write. This allows arbitrary file write and potentially remote code execution by overwriting application assets, configuration, cron or SSH files; the only guard is an extension allowlist that defaults to :any and checks just the extension. All ash_admin releases from 0.13.7 up to but not including 1.3.1 are affected, in Phoenix/Ash applications that expose AshAdmin's resource upload forms. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates a 0.6% probability of exploitation within 30 days.

What to do: Upgrade to ash_admin 1.3.1 or later, which strips path components from the client-supplied filename with Path.basename/1 before joining. As interim mitigations, tighten the upload extension allowlist away from :any, restrict the BEAM user's OS write permissions outside the application directory, and sanitize client-supplied filenames in any custom upload code. Audit servers for unexpected files written outside the temp upload directory, especially in priv/static, configuration paths, cron directories and ~/.ssh.