External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
Why this VPI (explainable, experimental)
VPI breakdown
| Impact | 96.00 |
| Exploitation signal(No additional exploitation signal) | ×1.00 |
| VPI | 96.00 |
VPI formula vpi-v1
This CVE is referenced in a KISA security bulletin (Korean only).