A path traversal flaw exists in Ivanti Xtraction versions earlier than 2026.4. The vulnerability permits a remote attacker who can authenticate to the application to create or modify arbitrary directories on the host file system. This can compromise configuration files, alter stored data, and potentially disrupt application functionality, thereby affecting the integrity of the affected system.

Ivanti Xtraction containers are impacted. The specific product is Ivanti Xtraction, and any deployments that have not been updated to version 2026.4 or later are vulnerable.

The CVSS score of 5 denotes moderate severity. No EPSS value is reported, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote authenticated session to the Xtraction service; the attacker must first authenticate and then supply a crafted path in a request that bypasses filename validation. Exploitability requires only legitimate credentials, so the threat is real for systems that expose the service to untrusted users.