AIKIDO-2026-785221

TL;DR

AshAdmin builds the destination path for uploaded files by joining a temporary directory with the browser-supplied file name without sanitizing it. A file name containing directory-traversal sequences escapes the temporary directory and writes to arbitrary locations the server process can reach. Because validation only checks the file extension, a traversal payload ending in an allowed extension still passes, enabling overwrite of application assets or configuration and potential code execution. The fix strips path components from uploaded file names before joining.