CVE-2026-90445: File Upload Path Traversal Vulnerability

CVE-2026-90445 Overview

CVE-2026-90445 is a path traversal vulnerability [CWE-22] in a file upload interface that extracts user-supplied archives without validating extracted file paths. An authenticated attacker can craft an archive containing entries with traversal sequences that escape the intended destination directory. The extraction process writes files to arbitrary locations using the privileges of the extracting process. Successful exploitation allows the attacker to inject fabricated records into stored data or tamper with application configuration files. The vulnerability was disclosed through a CISA Industrial Control Systems (ICS) advisory.

Critical Impact
An authenticated network-based attacker can write files to arbitrary paths on the target system, enabling configuration tampering and data injection.

Affected Products

Product details not specified in the public NVD record
Refer to the CISA CSAF advisory ICSA-26-254-01 for affected vendor and product versions
Industrial Control Systems environments referenced by the CISA advisory

Discovery Timeline

2026-09-11 - CVE-2026-90445 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90445

Vulnerability Analysis

The vulnerability resides in an archive extraction routine reachable through an authenticated file upload interface. The routine iterates over entries in a submitted archive and writes each entry to the destination directory without normalizing or validating the entry name. An attacker who authenticates to the application can upload a specially crafted archive containing entries whose names include directory traversal sequences. When the server extracts the archive, the traversal sequences cause the writer to resolve target paths outside the intended destination directory.

The impact scope is limited to integrity. Confidentiality and availability are not directly affected because the flaw governs where files are written, not what the attacker can read or disrupt. However, writing to sensitive configuration paths can indirectly enable follow-on attacks such as authentication bypass or code execution depending on the file targeted.

Root Cause

The extraction logic trusts archive entry names supplied by the client. It does not canonicalize the resolved path or verify that the canonical path is a descendant of the destination directory. This class of defect is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the upload interface and low-privilege authenticated credentials. No user interaction is required beyond the attacker's own upload action. The attacker crafts an archive whose entries contain sequences such as ../ in their internal names, then submits it through the upload endpoint. Upon extraction, files are written to attacker-chosen locations with the privileges of the extraction process.

No public proof-of-concept exploit is available at time of publication. See the CISA CSAF Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-90445

Indicators of Compromise

Archive files uploaded through the application containing entry names with ../, ..\, absolute paths, or encoded traversal sequences
Unexpected file creation or modification outside the designated upload or extraction directory
Application configuration files modified without a corresponding administrative change record
New or altered records in application data stores that do not correlate with normal user workflows

Detection Strategies

Log all archive uploads with the authenticated user, source IP, filename, and hash for later correlation
Statically inspect uploaded archives before extraction and reject entries whose names contain traversal sequences or absolute paths
Monitor filesystem write activity from the extracting service process and alert on writes outside the expected destination tree
Correlate authenticated upload events with subsequent modifications to configuration or data files

Monitoring Recommendations

Enable file integrity monitoring on application configuration directories and stored data files
Retain archive upload artifacts for forensic replay against the extraction routine
Alert on any process writing to directories outside its documented working paths

How to Mitigate CVE-2026-90445

Immediate Actions Required

Consult the CISA CSAF Security Advisory to identify the affected vendor, product, and fixed versions
Apply the vendor-supplied patch or update as soon as it is available in your environment
Restrict which authenticated users can access the file upload interface until patched
Audit recent archive uploads and extraction destinations for signs of exploitation

Patch Information

Patch availability is described in the vendor advisory referenced by CISA ICSA-26-254-01. Operators should review the CSAF document for remediation guidance and product-specific fixed version numbers. The NVD entry does not list vendor, product, or CPE identifiers at time of publication.

Workarounds

Disable the archive upload feature if the application permits it without impacting operations
Place the extraction service behind a network segment that limits access to trusted administrative users only
Run the extraction process under a least-privilege account that cannot write to configuration or data directories
Preprocess uploaded archives with a sanitizer that rejects entries containing traversal sequences, absolute paths, or symlinks

bash

# Configuration example: least-privilege service account and restricted write scope
# Replace paths and user with values appropriate to the affected product
useradd -r -s /usr/sbin/nologin extractsvc
chown -R extractsvc:extractsvc /var/app/uploads /var/app/extracted
chmod 750 /var/app/extracted
# Deny writes elsewhere via filesystem ACLs
setfacl -R -m u:extractsvc:--- /etc/app /var/app/config /var/app/data