CVE-2026-106047

Executive Summary

CVE-2026-106047 is a path traversal vulnerability (CWE-22) in the template export functionality of Ivanti Xtraction, affecting versions prior to 2026.4. A remote attacker who holds valid authenticated credentials can exploit the flaw to read arbitrary files on the underlying host, potentially exposing configuration files, credentials, and other sensitive data. With a CVSS base score of 7.7 (High) and a scope change (S:C), the vulnerability can impact resources beyond the vulnerable component, making it a significant risk for organizations running the affected platform.

Technical Analysis

The vulnerability resides in the template export functionality of Ivanti Xtraction. Path traversal (CWE-22) occurs when an application constructs a filesystem path using externally supplied input without adequately neutralizing directory traversal sequences (such as ../) or absolute path indicators. In the context of a template export feature, the application typically accepts a template name or identifier and resolves it to a file on disk before returning its contents to the user.

Because the description states the attacker is "remote authenticated," the vulnerable endpoint is reachable over the network and sits behind the application's authentication layer. The attacker must therefore possess a valid session or account. However, once authenticated, the lack of proper input validation on the template path allows the attacker to escape the intended template directory and read files elsewhere on the filesystem.

The CVSS vector indicates a network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and a changed scope (S:C). The scope change is notable: a file-read primitive in the template export function can affect components beyond the directly vulnerable module, since the read occurs under the web application's service account and can expose data belonging to other subsystems or the host operating system. Confidentiality is rated High (C:H), while Integrity and Availability are None, consistent with a pure information-disclosure primitive.

The exact parameter name, endpoint path, and code-level sanitization routine are not disclosed in the available NVD description. The precise ../ encoding behavior, whether the application follows symlinks, and whether absolute paths are accepted cannot be determined from the provided intelligence. Analysis should therefore be scoped to the vulnerability class and mechanism rather than to specific implementation details, which are unavailable.

Exploitation Scenarios

Note: No public PoC is available. The attack chain below is inferred from the path traversal vulnerability class and the vendor description. No specific function names, endpoints, or parameters are fabricated; only the described "template export functionality" is referenced.

1. Reconnaissance and target identification: The attacker identifies an internet- or intranet-exposed Ivanti Xtraction instance running a version prior to 2026.4. Fingerprinting is performed against the product's login interface or web application banner. The attacker obtains valid credentials — through legitimate provisioning, a compromised low-privileged account, or credential reuse — satisfying the PR:L requirement.

2. Triggering the flaw class: The attacker authenticates and navigates to the template export functionality. The application constructs a filesystem path based on user-supplied input (typically a template name or identifier). Because this input is not properly sanitized, the attacker can supply traversal sequences (../) to escape the intended template directory.

3. Payload/execution method (vulnerability-class level): Instead of a legitimate template name, the attacker submits a crafted value containing directory traversal sequences pointing to a sensitive file — for example, configuration files, credential stores, or system files reachable by the service account. The application resolves the path and returns the file contents in the export response. The exact payload format depends on how the export parameter is processed; only the traversal class (CWE-22) is confirmed, not a specific string.

4. Post-exploitation impact: The attacker gains read access to arbitrary files. This may yield credentials, API keys, database connection strings, or configuration data that enable lateral movement, privilege escalation, or further compromise. Because scope is changed (S:C), impact can extend to other components sharing the host filesystem or the same trust boundary. Integrity and availability remain unaffected, so the primary damage is information disclosure.

Impact Assessment

Business impact centers on confidentiality loss. Ivanti Xtraction instances are commonly deployed in IT service management and asset/configuration contexts, where the host may store integration credentials, service accounts, and configuration files. Disclosure of these files can enable downstream attacks: lateral movement into managed systems, abuse of API integrations, or privilege escalation using harvested credentials.

The blast radius is shaped by the scope change (S:C). A successful path traversal read executes with the privileges of the web application's service account; any file readable by that account becomes exposed. In hardened deployments the account is restricted, limiting exposure; in permissive deployments it may read system configuration or other tenants' data if the instance is multi-tenant.

CVSS subscores:

• AV:N — exploitable over the network.
• AC:L — no special conditions; standard traversal techniques apply.
• PR:L — requires valid credentials, reducing the pool of potential attackers to authenticated users.
• UI:N — no victim interaction required.
• S:C — impact can cross the component boundary.
• C:H / I:N / A:N — high confidentiality impact; no integrity or availability impact.

The base score of 7.7 (High) reflects serious data-exposure risk that is mitigated, but not eliminated, by the authentication requirement. There is no evidence of public exploit code, no Nuclei template, no CISA KEV listing, and EPSS has not yet been scored.

Detection Guidance

Sigma Rule

title: Ivanti Xtraction Template Export Path Traversal Attempt
id: 3f9c2a1e-7b4d-4c88-9a2f-1d5e6b7c8a90
status: experimental
description: Detects directory traversal sequences in requests to Ivanti Xtraction template export functionality, indicative of CVE-2026-106047 exploitation.
author: Security Team
date: 2026/01/01
logsource:
  category: webserver
  product: ivanti_xtraction
detection:
  selection_method:
    http.method: 'GET'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..\\'
  selection_export:
    cs-uri-stem|contains:
      - 'export'
      - 'template'
  condition: selection_method and selection_traversal and selection_export
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate template names containing dots or traversal-like substrings (rare)
level: high
tags:
  - attack.t1083
  - cve.2026.106047

YARA Rule

rule CVE_2026_106047_Ivanti_Xtraction_PathTraversal
{
    meta:
        description = "Detects path traversal sequences targeting Ivanti Xtraction template export functionality (CVE-2026-106047)"
        author = "Security Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106047"
        severity = "high"

    strings:
        $t1 = "template" nocase
        $t2 = "export" nocase

        $p1 = "../" ascii
        $p2 = "..\\" ascii
        $p3 = "%2e%2e%2f" ascii nocase
        $p4 = "..%2f" ascii nocase
        $p5 = "..%5c" ascii nocase
        $p6 = "%2e%2e/" ascii nocase
        $p7 = "%252e%252e%252f" ascii nocase

        $s1 = "etc/passwd" ascii
        $s2 = "win.ini" ascii
        $s3 = "web.config" ascii nocase
        $s4 = "application.properties" ascii nocase

    condition:
        (uint16(0) == 0x4854 or uint16(0) == 0x4f50 or uint16(0) == 0x4f47) and
        any of ($t*) and
        any of ($p*) and
        any of ($s*)
}

Note: The condition heuristically checks for HTTP/GET/POST magic bytes at file offset 0 to target captured HTTP request streams; adjust to deployment context.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106047 Ivanti Xtraction Template Export Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"export"; nocase; http.uri; content:"template"; nocase; http.uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\.\.%2f|\.\.%5c)/i"; classtype:web-application-attack; reference:cve,2026-106047; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106047; sid:2026106047; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  (http.request.uri.path : "*export*" or http.request.uri.path : "*template*") and
  (http.request.uri.query : "*../*" or
   http.request.uri.query : "*..%2f*" or
   http.request.uri.query : "*..%5c*" or
   http.request.uri.query : "*%2e%2e%2f*" or
   http.request.uri.query : "*%2e%2e/*" or
   http.request.uri.query : "*\\..\\..\\*")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=ivanti:xtraction:access
| eval uri_lower = lower(uri)
| where (like(uri_lower, "%export%") OR like(uri_lower, "%template%"))
| search uri_lower="*../*" OR uri_lower="*..%2f*" OR uri_lower="*..%5c*" OR uri_lower="*%2e%2e%2f*" OR uri_lower="*%2e%2e/*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as attempted_paths by src_ip, user
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="ivanti_xtraction,web,attack,">
  <rule id="100600" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">GET</field>
    <field name="http.uri">\.\./</field>
    <description>CVE-2026-106047 - Ivanti Xtraction template export path traversal attempt detected</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_106047,</group>
  </rule>

  <rule id="100601" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.uri">\.\.%2f</field>
    <description>CVE-2026-106047 - Encoded path traversal sequence to Ivanti Xtraction template export detected</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_106047,</group>
  </rule>

  <rule id="100602" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.uri">%2e%2e%2f</field>
    <description>CVE-2026-106047 - URL-encoded dot-dot-slash traversal to Ivanti Xtraction detected</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_106047,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict network access to the Ivanti Xtraction instance so that only trusted networks/administrators can reach the web interface.
• Enforce least privilege for the Ivanti Xtraction service account so that it cannot read sensitive files outside its application directory (filesystem ACLs, container read-only mounts, chroot-style isolation).
• Disable or restrict the template export functionality if it is not business-critical until a fix is applied.
• Monitor and alert on traversal patterns in requests to the template export functionality using the detection rules above.
• Audit authenticated accounts and remove unused or unnecessary accounts to reduce PR:L exposure.

2. Patch/upgrade steps:

• Upgrade to Ivanti Xtraction 2026.4 or later, in which the path traversal issue is reported to be addressed.
• Because no patch evidence is available from tracked sources, verify the vendor's official advisory and release notes directly before relying on any specific version as fixed, and validate that the deployed build number matches the fixed release.
• Since this is an unpatched state per current intelligence, coordinate with Ivanti support for an available hotfix or interim guidance.

3. Long-term hardening:

• Implement strict allowlisting of template identifiers and normalize file paths before use on the server side (canonicalize and confirm the resolved path remains within the intended directory).
• Apply defense-in-depth: run the application with minimal filesystem permissions, segment it from critical data stores, and store secrets outside files reachable by the service account.
• Adopt a vulnerability management cadence that tracks Ivanti advisories and applies updates promptly.

References

• NVD — CVE-2026-106047: https://nvd.nist.gov/vuln/detail/CVE-2026-106047
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Ivanti Security Advisories (vendor advisory portal): https://www.ivanti.com/security
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — not listed at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign note: No exploit-in-the-wild evidence, public PoC, or CISA KEV listing is currently associated with CVE-2026-106047 based on the provided intelligence.