CoreCVE
Back

CRITICAL

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks

Published May 12, 2026

Description

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-73

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner ivanti
Published May 12, 2026
Updated May 12, 2026
Reserved May 6, 2026
Link CVE-2026-8043
CISA Vulnrichment
Updated May 12, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-8043
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-8043