CVE-2026-82673: ash_admin Path Traversal Vulnerability

CVE-2026-82673 Overview

CVE-2026-82673 is a path traversal vulnerability [CWE-22] in the ash_admin library for the Ash framework in Elixir. The flaw resides in AshAdmin.Components.Resource.Form.consume_file_uploads/1, which constructs the destination path for uploaded files using the browser-supplied filename without sanitization. An authenticated attacker can supply a filename containing ../ sequences to escape the temporary directory and write attacker-controlled bytes to arbitrary locations writable by the BEAM user. The issue affects ash_admin from version 0.13.7 up to but not including 1.3.1.

Critical Impact
Arbitrary file write in server-writable paths can lead to remote code execution through overwriting application assets, configuration files, or cron and SSH files.

Affected Products

ash-project ash_admin>= 0.13.7
ash-project ash_admin< 1.3.1
Elixir/Phoenix applications embedding AshAdmin's resource form component

Discovery Timeline

2026-08-31 - CVE-2026-82673 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82673

Vulnerability Analysis

The vulnerable code path processes multipart file uploads submitted through the AshAdmin resource form. The function generates a random temporary directory, then joins it with entry.client_name using Path.join/1 and copies the uploaded payload with File.cp!/2. Because Path.join/1 does not normalize .. segments, a crafted client_name such as ../../../../var/www/app/priv/static/x.png resolves to a destination outside the intended temporary directory. Any user authorized to submit uploads through the admin form can trigger arbitrary file write as the BEAM operating system user.

Root Cause

The root cause is missing sanitization of user-controlled filename data before path construction. AshAdmin's only guard is an extension allowlist that defaults to :any and checks only the file extension, not the directory portion of the filename. The fix strips directory components using Path.basename/1 before joining, restricting writes to the generated temporary directory.

Attack Vector

The attack requires network access to the AshAdmin interface and low-privilege authenticated access sufficient to reach a resource form that accepts uploads. An attacker submits a file upload where the client_name header contains directory traversal segments. Depending on filesystem permissions, the attacker can overwrite static assets served by Phoenix, drop scripts into cron directories, replace SSH authorized_keys, or modify Elixir release configuration to achieve remote code execution on the next process restart.

elixir

           random_string = for _ <- 1..10, into: "", do: <<Enum.random(~c"0123456789abcdef")>>
 
           tmp_dir = Path.join([System.tmp_dir!(), random_string])
-          tmp_file = Path.join([tmp_dir, entry.client_name])
+          # `entry.client_name` is the browser-supplied filename; strip any path
+          # components so a name like `../../etc/x` cannot escape tmp_dir.
+          tmp_file = Path.join([tmp_dir, Path.basename(entry.client_name)])
 
           File.mkdir_p!(tmp_dir)
           File.cp!(path, tmp_file)

Source: GitHub Commit 4bb41cb — the patch strips directory components from the client-supplied filename before joining with the temporary directory.

Detection Methods for CVE-2026-82673

Indicators of Compromise

Files created outside System.tmp_dir!() with modification timestamps correlating to AshAdmin upload requests.
HTTP multipart requests to AshAdmin endpoints containing Content-Disposition: filename="..." values with ../ or absolute path segments.
Unexpected changes to priv/static/, release configuration files, ~/.ssh/authorized_keys, or cron directories owned by the BEAM runtime user.
Newly written executables or scripts in directories writable by the Elixir application user.

Detection Strategies

Inspect Phoenix and reverse proxy access logs for POST requests to AshAdmin resource form paths carrying filenames with traversal sequences.
Enable filesystem auditing (auditd on Linux) on directories containing application assets, secrets, and user authorization files.
Correlate file integrity monitoring events against the process identifier of the BEAM runtime.

Monitoring Recommendations

Alert on any write by the BEAM user process outside expected working directories such as the temp path and release log directories.
Monitor authentication events for AshAdmin accounts and flag first-time upload activity from new sessions.
Track version pinning of ash_admin in dependency manifests and alert on deployments running versions below 1.3.1.

How to Mitigate CVE-2026-82673

Immediate Actions Required

Upgrade ash_admin to version 1.3.1 or later in mix.exs and redeploy affected applications.
Restrict access to the AshAdmin mount point to trusted administrator networks or VPN-only routes.
Audit filesystem state for unauthorized files in asset, configuration, cron, and SSH directories since the vulnerable version was deployed.

Patch Information

The fix is committed in ash-project/ash_admin commit 4bb41cb and included in release 1.3.1. Details are documented in the GHSA-483p-rgcq-p5j9 advisory and the OSV report EEF-CVE-2026-82673.

Workarounds

Temporarily disable file upload fields in AshAdmin resource forms until the patch is applied.
Run the BEAM process under a dedicated unprivileged user with a minimal writable filesystem footprint.
Place the AshAdmin route behind additional authentication such as mTLS or an identity-aware proxy.

bash

# Update ash_admin in mix.exs and fetch the patched release
# {:ash_admin, "~> 1.3.1"}
mix deps.update ash_admin
mix deps.get
mix compile