CVE-2026-21822: HCLSoftware AppScan Path Traversal Flaw

CVE-2026-21822 Overview

HCLSoftware AppScan 360° contains a path traversal vulnerability [CWE-22] in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory. Exploitation can expose the application's file system structure or enable unauthorized file modification within the application's directory scope.

The flaw is network-exploitable and requires low-level authentication. No user interaction is needed to trigger the vulnerable code path. HCLSoftware published a knowledge base article documenting the issue and remediation guidance.

Critical Impact
An authenticated attacker on the network can read or write files outside the intended directory in the ASReportService component, enabling reconnaissance and unauthorized file modification within AppScan 360°.

Affected Products

HCLSoftware AppScan 360°
ASReportService component within AppScan 360°
Refer to the vendor advisory for specific affected versions

Discovery Timeline

2026-09-18 - CVE CVE-2026-21822 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-21822

Vulnerability Analysis

The vulnerability resides in the ASReportService component of AppScan 360°. The service accepts file path input without sufficient validation, permitting traversal sequences such as ../ to escape the intended working directory. An authenticated attacker with low privileges can leverage this behavior to reach arbitrary files reachable by the service account.

Both read and write primitives are exposed. The read primitive enables enumeration of application configuration, logs, and internal file structure. The write primitive allows overwriting or planting files within the application's directory scope, which can support persistence or tampering with report artifacts.

Because exploitation is authenticated, any account with access to the reporting functionality expands the impact of credential compromise. In multi-tenant AppScan 360° deployments, this may allow one authenticated user to affect data belonging to other users of the service.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The ASReportService fails to canonicalize and validate file path input against an allow-listed base directory before performing file I/O operations. Traversal metacharacters embedded in user-controlled input are honored by the underlying file API.

Attack Vector

The attack vector is network-based. An authenticated attacker submits crafted requests to the ASReportService endpoint containing relative path traversal sequences in a filename or path parameter. The service resolves the manipulated path against the process working directory, granting access to files outside the intended report storage location.

See the HCL Software Knowledge Article for vendor technical details.

Detection Methods for CVE-2026-21822

Indicators of Compromise

Web or application logs containing path traversal sequences such as ../, ..\, %2e%2e%2f, or URL-encoded variants directed at the ASReportService endpoint.
Unexpected file read or write operations by the AppScan 360° service account outside of the configured report output directory.
Access to sensitive files (configuration files, credential stores, application binaries) correlated with authenticated AppScan 360° sessions.

Detection Strategies

Inspect HTTP request payloads and query strings sent to ASReportService for traversal metacharacters and encoded equivalents.
Baseline the file paths legitimately accessed by AppScan 360° and alert on deviations, particularly writes outside expected report directories.
Correlate authenticated user sessions with file system telemetry to identify accounts issuing anomalous report requests.

Monitoring Recommendations

Enable verbose logging on the ASReportService component and forward logs to a centralized analytics platform for retention and correlation.
Monitor process-level file operations on the AppScan 360° host to identify traversal outside the intended report directory.
Review authentication logs for the AppScan 360° application to identify low-privilege accounts issuing reporting requests at abnormal rates.

How to Mitigate CVE-2026-21822

Immediate Actions Required

Consult the HCL Software Knowledge Article and apply the fixed release identified by HCLSoftware for AppScan 360°.
Rotate credentials for AppScan 360° accounts, particularly any low-privilege accounts with access to reporting functionality.
Audit file system contents within the AppScan 360° installation directory for unauthorized files or modifications.

Patch Information

HCLSoftware has published remediation guidance in knowledge base article KB0133460. Administrators should review the article and upgrade AppScan 360° to the vendor-specified fixed version. No public exploit code is currently known, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Restrict network access to the AppScan 360° management and reporting interfaces to trusted administrative networks only.
Limit access to the reporting functionality to a minimal set of authenticated users pending patch deployment.
Run the AppScan 360° service under a least-privileged account so that traversal outside its working directory yields minimal reachable content.

bash

# Example: restrict inbound access to AppScan 360° reporting service via firewall
# Replace <mgmt_cidr> and <appscan_port> with values for your environment
iptables -A INPUT -p tcp --dport <appscan_port> -s <mgmt_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport <appscan_port> -j DROP