CVE-2026-85409

Executive Summary

CVE-2026-85409 is a path traversal vulnerability (CWE-22) in Eleveo Quality Management version 9.7.0. The flaw resides in the Questionnaire Service component, specifically within the QuestionnaireService.runDataExportNow function, where manipulation of the file_name argument allows an authenticated remote attacker to traverse directories outside the intended export path. The vendor was contacted but has not responded, and no patch is currently available. Successful exploitation could lead to unauthorized file read/write access, data exfiltration, or arbitrary file manipulation on the target system, with a CVSS base score of 6.3 (Medium) reflecting limited confidentiality, integrity, and availability impact.

Technical Analysis

Eleveo Quality Management is an enterprise contact center quality assurance platform designed to record, analyze, and score customer interactions. The affected component, Questionnaire Service, handles survey and evaluation data management, including scheduled and on-demand export operations.

The vulnerability class is path traversal (CWE-22), which occurs when user-supplied input is used to construct file paths without adequate sanitization or validation. In this case, the runDataExportNow function accepts a file_name parameter that is not properly validated to prevent directory traversal sequences such as ../ or absolute path references. An authenticated attacker who can invoke this function can provide a malicious filename that escapes the intended export directory.

Since runDataExportNow initiates an asynchronous data export operation, the traversal likely results in file write operations (exported data being written to an arbitrary location) or file read operations (exported data paths referencing files outside the intended scope). The CVSS vector indicates the vulnerability requires low-privilege authentication, executes over the network without user interaction, and affects the vulnerable component only (no scope change).

Insufficient technical detail is available in the public disclosure to determine the exact traversal payload structure, the output encoding used in export files, or whether traversal affects both read and write operations with equal severity. The presence of a publicly available exploit suggests the technique is straightforward and likely requires only HTTP request manipulation of the file_name argument within the Questionnaire Service API endpoint.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker would first identify Eleveo Quality Management 9.7.0 instances exposed to the network. Shodan queries such as product:"Eleveo" or http.html:"Eleveo" could locate potential targets. The attacker would then need to obtain valid credentials with low-level privileges, as the CVSS vector requires PR:L (low privileges). This could involve credential stuffing, phishing, or leveraging default credentials on exposed instances.

Step 2: Triggering the Vulnerability

Once authenticated, the attacker identifies the Questionnaire Service API endpoint that invokes the runDataExportNow function. The attacker crafts an HTTP request that includes a file_name parameter containing path traversal sequences. For example:

file_name=../../../../windows/system32/sensitive_config.ini

or on Linux systems:

file_name=../../../../etc/passwd

The manipulation of this argument causes the application to resolve the path outside the intended export directory.

Step 3: Execution Method

At the vulnerability-class level, the attacker triggers the runDataExportNow function with a modified file_name parameter. The application fails to sanitize or normalize the input path, allowing directory traversal. The export operation then reads from or writes to the attacker-specified location. If the export function writes data, the attacker could potentially overwrite application configuration files or write malicious content to web-accessible directories, enabling additional attacks. If the function reads data, the attacker could exfiltrate sensitive files from the server file system.

Step 4: Post-Exploitation Impact

Post-exploitation activities depend on the successful exploitation outcome. File write access could allow the attacker to place web shells in web-accessible directories, achieving remote code execution. File read access could expose sensitive data including database credentials, customer information from recorded interactions, configuration files containing API keys, and other internal data. The low integrity and availability subscores suggest that exploitation may not grant full system compromise but could serve as a foothold for lateral movement or privilege escalation.

Impact Assessment

Business Impact: Eleveo Quality Management handles sensitive contact center data, including customer recordings, agent performance metrics, and quality assurance scores. Exploitation of this vulnerability could expose customer personally identifiable information (PII), call recordings, internal evaluation data, and system configuration files. This could lead to regulatory non-compliance (GDPR, CCPA, or industry-specific regulations like PCI-DSS), reputational damage, and loss of customer trust.

Affected Systems: All Eleveo Quality Management 9.7.0 deployments with the Questionnaire Service component enabled and accessible to authenticated users. Systems on internal networks are also at risk if an attacker gains initial foothold through other means.

Blast Radius (per CVSS subscores):

• Confidentiality Impact: Low (L) — Limited to files accessible to the service account running the application.
• Integrity Impact: Low (L) — Depending on write capabilities, an attacker may modify or overwrite files.
• Availability Impact: Low (L) — No direct denial-of-service vector identified.
• Attack complexity is Low, and no user interaction is required; the main barrier is the low-privilege authentication requirement.

Exploit Availability: The NVD description states the exploit is publicly available and might be used. This increases urgency for affected organizations despite the absence of a formal PoC in the tracked sources.

Detection Guidance

Sigma Rule

title: Eleveo Quality Management Path Traversal Attempt
id: 0b8b8e3a-05c0-4a7b-9d4f-5c0f2d3a8e6b
status: experimental
description: Detects path traversal attempts targeting the QuestionnaireService.runDataExportNow function
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85409
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: application
    product: eleveo
    service: quality_management
detection:
    selection_main:
        http.url|contains: 'runDataExportNow'
    selection_traversal:
        http.url|contains:
            - '..%2F'
            - '..%5C'
            - '..\\'
            - '../'
            - '....//'
        http.url|re: 'file_name=(\.\.\/|[a-zA-Z]:[\\\/]|\/etc\/|\/var\/|\/windows\/)'
    condition: selection_main and selection_traversal
falsepositives:
    - Legitimate exports to custom directories may trigger alerts if system uses path-based filenames
level: high

YARA Rule

rule CVE_2026_85409_Eleveo_PathTraversal {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal attempt patterns targeting Eleveo Quality Management Questionnaire Service"
        score = 60
        date = "2026-01-15"
        cve = "CVE-2026-85409"
    strings:
        $function = "runDataExportNow" ascii nocase
        $file_param = "file_name" ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "..%2f" ascii nocase
        $traversal4 = "..%5c" ascii nocase
        $unicode1 = "..%c0%af" ascii nocase
        $unicode2 = "..%c1%9c" ascii nocase
        $root1 = "/etc/passwd" ascii
        $root2 = "%SYSTEMROOT%" ascii nocase
        $root3 = "boot.ini" ascii nocase
        $root4 = "/proc/" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10MB and
        1 of ($function, $file_param) and
        2 of ($traversal*) or
        (1 of ($function) and 1 of ($root*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-85409 Eleveo Quality Management Path Traversal Attempt"; flow:established,to_server; content:"runDataExportNow"; http_uri; nocase; pcre:"/(file_name=)[^&]*?(\.\.\/|\.\.\\|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c)/iU"; classtype:attempted-admin; reference:cve,2026-85409; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85409; sid:202685409; rev:1; priority:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "connection_established"]
  [http where event.action == "request" and 
     url.path contains "runDataExportNow" and 
     (url.query contains "..%2f" or
      url.query contains "..%5c" or
      url.query contains "../" or
      url.query contains "..\\" or
      url.query matches ".*file_name=.*%2e%2e%2f.*" or
      url.query matches ".*file_name=.*%2e%2e%5c.*")] |
  [process where event.action == "executed" and process.args contains "export" or
   file where event.action in ("creation", "modification") and 
     (file.path contains ".." or file.name matches "*.config" or file.name == "passwd")]

Splunk SPL Query

index=proxy OR index=web OR index=app
  earliest=-7d
| where match(_raw, "(?i)runDataExportNow") AND 
        match(_raw, "(?i)(\.\./|\.\.\\|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c)")
| rex field=_raw "src_ip=(?<source_ip>[^ ]+)"
| rex field=_raw "url=(?<request_url>[^ ]+)"
| rex field=_raw "user=(?<username>[^ ]+)"
| table _time, source_ip, username, request_url, src_port, dest_port
| sort - _time
| eval threat_score=case(
      match(request_url, "(?i)(/etc/passwd|boot\.ini|win\.ini)"), "Critical",
      match(request_url, "(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f)"), "High",
      true(), "Medium")
| outputlookup eleveo_traversal_hits.csv
| stats count by source_ip, username, threat_score
| where count > 3

Wazuh OSSEC Rule

<group name="web,app,eleveo,">
  <rule id="100854" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">runDataExportNow</field>
    <regex>\.\.|%2e%2e|%2f|%5c</regex>
    <description>CVE-2026-85409 - Eleveo Quality Management path traversal attempt detected in Questionnaire Service</description>
    <group>path_traversal,attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  
  <rule id="100855" level="15" frequency="5" timeframe="120">
    <if_matched_sid>100854</if_matched_sid>
    <description>CVE-2026-85409 - Multiple path traversal attempts targeting Eleveo runDataExportNow within 2 minutes</description>
    <group>path_traversal,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-85409 is UNPATCHED. The vendor was contacted early about this disclosure but did not respond. Patch confidence is 0/4, indicating no evidence of a fix from any tracked source. No mitigation guidance has been published by the vendor.

Immediate Mitigations:

1. Restrict Access: Implement network-level access controls to limit access to the Eleveo Quality Management application to trusted IP ranges only. This reduces the attack surface by preventing remote unauthenticated or low-privilege attempts.
2. Review and Revoke User Privileges: Audit all user accounts with access to the Questionnaire Service functions, particularly those with low-level privileges that can invoke runDataExportNow. Revoke accounts that no longer require access.
3. Web Application Firewall (WAF) Rules: Deploy virtual patching rules using the detection patterns provided above, blocking requests containing path traversal sequences in the file_name parameter.
4. Monitor Logs: Enable enhanced logging for the Questionnaire Service and monitor for anomalies in runDataExportNow invocations, especially requests with unusual file_name values.
5. File System Permissions: Ensure the service account running Eleveo Quality Management has least-privilege access, limiting the blast radius of any successful traversal.

Patch/Upgrade Steps:

• Currently, no vendor patch is available. Monitor the vendor's official security advisories and CVE notification channels for updates.
• Contact Eleveo support directly to inquire about patched releases or emergency fixes.
• If newly patched versions are released, test in a staging environment before production deployment.
• Consider compensating controls if no vendor action is taken within an acceptable timeframe.

Long-Term Hardening:

• Implement a formal vulnerability management program that includes regular security assessments of third-party applications.
• Integrate Eleveo platform monitoring into the SOC's detection stack using the provided detection rules.
• Evaluate whether the Questionnaire Service should be accessible to all authenticated users or restricted to a smaller administrative subset.
• Establish a vendor communication channel to ensure timely response to future security disclosures.
• Consider input validation at the application layer as a defense-in-depth measure, although this requires vendor implementation for proper remediation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-85409
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
3. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-85409
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns / Exploit-in-the-Wild Activity: As of this report date, CVE-2026-85409 is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor campaigns have been publicly attributed to this vulnerability. However, the NVD description explicitly notes that the exploit is publicly available and might be used, indicating real-world exploitation potential. No exploit code is available in the tracked sources, but the straightforward nature of path traversal vulnerabilities suggests that a capable attacker could develop working exploit code from the disclosed information. Organizations should assume active exploitation risk and prioritize the mitigations described above. Shodan assessment indicates potentially exposed Eleveo Quality Management instances that could be vulnerable, making network-level detection and access restriction critical control measures.