CVE-2026-106034
MediumCVSS 5.0Summary
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
Risk Assessment
An attacker can create and modify arbitrary directories on the server, potentially leading to system corruption or further privilege escalation.
Recommendation
Update Ivanti Xtraction to version 2026.4 or later and review permissions of authenticated accounts with access to the application.
Other vulnerabilities in Ivanti Xtraction
See all- CVE-2026-106047High
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
- CVE-2026-106043High
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify trusted site.
- CVE-2026-106042Critical
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
- CVE-2026-8043Critical
In Ivanti Xtraction before version 2026.2, external control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- CVE-2026-14903High
A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902Medium
An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Original NVD description (English source)
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS