Executive brief
ash_admin is a web administration component used to manage Phoenix/Elixir applications. An attacker can upload files with specially crafted names (e.g., "../../../../var/www/app/config.txt") to bypass directory restrictions and write arbitrary files to the server, potentially leading to remote code execution by overwriting application files, configuration, or system scripts.
Technical details
The vulnerability is a path traversal (CWE-22) in the file upload handler. The vulnerable code in AshAdmin.Components.Resource.Form.consume_file_uploads/1 uses Path.join([tmp_dir, entry.client_name]) to build the destination path without sanitizing the user-supplied filename (entry.client_name). The Path.join/1 function does not normalize path traversal sequences like "..", allowing an attacker to escape the temporary directory. An upload named "../../../../var/www/app/priv/static/x.png" can land in arbitrary writable locations. The only existing guard is an extension allowlist that checks only the file extension, which is insufficient. The fix applies Path.basename/1 to strip path components before joining.
Affected products
- ash-project ash_admin 0.13.7 before 1.3.1
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: fix available in 1.3.1