External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
为什么是这个 VPI(可解释·实验性)
VPI 计算依据
| 影响度 | 96.00 |
| 利用信号(无额外利用信号) | ×1.00 |
| VPI | 96.00 |
VPI 公式 vpi-v1