A path traversal vulnerability in the ash_admin package allows authenticated users to achieve arbitrary file writes, creating a critical risk of remote code execution.

This is a path traversal vulnerability (CWE-22) occurring within the AshAdmin.Components.Resource.Form.consume_file_uploads/1 function. The application fails to sanitize the client provided filename, allowing an authenticated attacker to escape the intended temporary directory and write files to arbitrary locations on the server.

The ability to write arbitrary files to the server provides an attacker with the capability to overwrite critical application assets, configuration files, or system binaries. This level of access typically results in full system compromise, remote code execution, and potential data exfiltration. Given the CVSS score of 8.3, this high severity vulnerability necessitates immediate remediation to prevent unauthorized system control.

Immediate Action: Upgrade the ash_admin package to version 1.3.1 or later to implement proper filename sanitization using Path.basename/1.

Proactive Monitoring: Review web server logs for file upload requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at administration endpoints.

Compensating Controls: Implement strict file type validation and rename uploaded files to randomized strings on the server side to neutralize path injection attempts if an immediate update is not feasible.

Public Exploit Available: Unknown

The risk posed by this path traversal vulnerability is significant, as it provides a clear path to full system compromise for any authenticated user. Organizations utilizing the ash_admin package should prioritize updating to the patched version immediately. Failure to address this vulnerability allows an attacker to bypass directory restrictions and execute arbitrary commands on the underlying server.