CVE-2026-67395: Sage Employee Self Service Path Traversal

CVE-2026-67395 Overview

CVE-2026-67395 is a path traversal vulnerability [CWE-22] in the custom logo functionality of Sage Employee Self Service, part of Sage HRMS. The flaw stems from improper validation of file path parameters supplied to the logo handler. An unauthenticated remote attacker can submit directory traversal sequences, including encoded variants, to escape the intended directory and read arbitrary files on the host. Successful exploitation requires prior knowledge of valid file names and paths, which raises attack complexity. Depending on the privileges of the affected component, exploitation may expose configuration files, environment settings, application assets, and log data. Sage has remediated the issue through enhanced path validation and secure path resolution controls.

Critical Impact
Unauthenticated remote disclosure of sensitive files outside the application scope, including configuration, environment, and log data.

Affected Products

Sage Employee Self Service (custom logo functionality)
Sage HRMS (versions prior to the Q2 2026 product update)
Deployments exposing the Employee Self Service web interface to untrusted networks

Discovery Timeline

2026-09-01 - CVE-2026-67395 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-67395

Vulnerability Analysis

The vulnerability resides in the Employee Self Service component responsible for serving customer-supplied logo files. The handler accepts a file path parameter and passes it to the file system layer without sufficient canonicalization. Attackers can traverse outside the intended asset directory using sequences such as ../ and their URL-encoded or double-encoded equivalents. Because the request is served over the network and requires no authentication, remote attackers can attempt exploitation directly against the web endpoint. The impact is limited to confidentiality: the flaw permits arbitrary file reads but does not modify data or degrade availability.

Root Cause

The underlying cause is missing or incomplete path canonicalization before file resolution. The application trusts the client-supplied path fragment and concatenates it with a base directory. Encoded traversal sequences bypass simple string-based filters that block only literal .. characters. Without resolving the final path and confirming it remains inside the permitted directory, the handler returns the contents of any file readable by the service account.

Attack Vector

An attacker sends a crafted HTTP request to the Employee Self Service logo endpoint with a manipulated path parameter. The request replaces the expected file name with a relative path that walks up the directory tree to targets such as web.config, application settings files, or IIS log directories. Exploitation succeeds when the attacker already knows or can guess the target file names, which restricts opportunistic attacks. See the Sage HRMS Release Notes Q2 2026 for vendor-supplied remediation details.

Detection Methods for CVE-2026-67395

Indicators of Compromise

HTTP requests to the Employee Self Service logo endpoint containing ../, ..%2f, %2e%2e%2f, or double-encoded traversal sequences in path parameters
Web server access logs showing 200 responses to logo requests referencing non-image file names such as web.config, .env, or log files
Unexpected read access to Sage HRMS configuration or log directories by the IIS worker process

Detection Strategies

Inspect IIS and application logs for logo handler requests where the file parameter deviates from expected image file names or extensions
Deploy Web Application Firewall (WAF) signatures that flag encoded path traversal patterns in query strings and body parameters
Correlate outbound responses from the logo endpoint with abnormal content types or oversized payloads that suggest non-image file disclosure

Monitoring Recommendations

Enable verbose HTTP request logging on the Employee Self Service front end and forward logs to a centralized analytics platform
Alert on repeated 4xx or 5xx responses from the logo endpoint, which often indicate traversal probing before a successful request
Baseline file access patterns for the Sage HRMS service account and alert on reads outside expected asset directories

How to Mitigate CVE-2026-67395

Immediate Actions Required

Apply the Sage HRMS Q2 2026 product update, which introduces enhanced path validation and secure path resolution
Restrict network exposure of the Employee Self Service portal to trusted networks or VPN users until patching is complete
Rotate any credentials, API keys, or secrets stored in configuration files that may have been exposed through prior exploitation attempts

Patch Information

Sage has remediated CVE-2026-67395 through enhanced path validation and secure path resolution controls that prevent access to unauthorized locations. Administrators should install the update described in the Sage HRMS Release Notes Q2 2026 and verify version numbers on all Employee Self Service instances after deployment.

Workarounds

Place a WAF or reverse proxy in front of Employee Self Service and block requests containing encoded or literal traversal sequences
Constrain the file system permissions of the IIS application pool identity so it cannot read sensitive files outside the web root
Disable the custom logo functionality where it is not required, reducing the exposed attack surface until the patch is applied

bash

# Example WAF rule concept for blocking traversal in the logo endpoint
# (adapt syntax to your WAF platform)
SecRule REQUEST_URI "@rx (?i)(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f|%252e%252e%252f)" \
    "id:1026673950,phase:1,deny,status:403,\
     msg:'CVE-2026-67395 path traversal attempt against Sage ESS logo endpoint'"