AshAdmin allows file uploads by concatenating the temporary directory with the browser‑supplied filename without sanitizing path components, enabling a path traversal attack. By uploading a file named "../../../../var/www/app/priv/static/x.png", an attacker can write data to an arbitrary path the BEAM user can write. This arbitrary file write can be used to overwrite application assets, configuration files, or system scripts such as cron or SSH files, potentially leading to remote code execution.

The vulnerability exists in ash-project's AshAdmin component, affecting versions from 0.13.7 up to but not including 1.3.1. Systems running any of these releases are at risk.

The CVSS score of 8.3 classifies this as a high‑severity vulnerability. EPSS is not available and the issue is not listed in CISA KEV, indicating no known large‑scale exploitation yet. The likely attack vector is via the file upload endpoint, which accepts user‑provided filenames; an attacker who can reach this endpoint can supply a forged filename containing traversal sequences. Successful exploitation would result in arbitrary file creation or modification, and if the attacker can overwrite executable assets or critical scripts, remote code execution is possible.