SecBoard
Zurück zur CVE-Übersicht

CVE-2026-92919

HIGH(8.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 8.1 — Hoch

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.1

Technische Schwere

Beschreibung

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 3.0.0

Threat-Hunting-Queries

This query looks for file write operations outside of expected storage directories, which could indicate path traversal. Customization is needed to define 'expected_storage_paths' for your environment.

Sentinel/Defender KQL

DeviceFileEvents
| where ActionType == "FileCreated" or ActionType == "FileModified"
| where InitiatingProcessFileName contains "java" or InitiatingProcessCommandLine contains "admin3"
| where FolderPath !startswith "C:\\path\\to\\expected_storage_root" // Customize this path
| where FileName contains "..\\" or FileName contains "../"

Splunk SPL

index=your_index_name (sourcetype=your_file_event_sourcetype OR sourcetype=your_process_event_sourcetype)
| (process_name="java" OR command_line="*admin3*")
| (action="file_create" OR action="file_modify")
| NOT path="*\\path\\to\\expected_storage_root\\*" // Customize this path
| (file_name="*..\\*" OR file_name="*../*")

Sigma

title: Admin3 Path Traversal Write
id: cve-2026-92919-path-traversal
status: experimental
description: Detects attempts to write files outside the intended storage root in admin3 applications via path traversal.
author: SecBoard
date: 2024/07/30
logsource:
  category: file_event
  product: windows
detection:
  selection:
    EventID: "4663" # File created/modified
    ProcessName|endswith: "java.exe"
    CommandLine|contains: "admin3"
    TargetFilename|contains: "..\\"
  filter_legitimate_paths:
    TargetFilename|startswith: "C:\\path\\to\\expected_storage_root" # Customize this path
  condition: selection and not filter_legitimate_paths
level: high

Elastic ES|QL

FROM file_event
| WHERE event.action IN ("file_create", "file_change")
| WHERE process.executable.name == "java.exe" OR process.command_line : "*admin3*"
| WHERE file.path : "*..\\*" OR file.path : "*../*"
| WHERE NOT file.path : "C:\\path\\to\\expected_storage_root\\*" // Customize this path

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (3)

  • admin3.wetech.tech
  • gitpod.io
  • metacode.wetech.tech

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen