A path traversal flaw exists in the template export process of Ivanti Xtraction prior to version 2026.4. This flaw permits an authenticated user to craft a request that extracts files outside the intended export directory, thereby exposing sensitive system or administrative files. The impact is a breach of confidentiality, allowing an attacker to read any file that the Xtraction service process can access on the underlying host.

Ivanti Xtraction deployments with versions earlier than 2026.4 are affected. The specific product is the Xtraction application component that handles template export.

The CVSS score of 7.7 indicates a high severity of confidentiality compromise. EPSS information is not available, so the probability of exploitation cannot be quantified precisely. The vulnerability is not listed in the CISA KEV catalog, meaning there is no current evidence of widespread exploitation. The attack requires authentication, so the threat surface is limited to users with valid credentials to the Xtraction system.