Description

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file_name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-04T05:17:15.897Z",
  "pubdate": "2026-09-04T05:17:15.897Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the QuestionnaireService component of Eleveo Quality Management 9.7.0. The flaw resides in the runDataExportNow function, which fails to properly sanitize the file_name argument before processing file system operations.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate file paths, potentially leading to unauthorized file access, disclosure of sensitive information, or the overwriting of critical system files.\nThe risk is exacerbated by the availability of public exploit code, posing an immediate threat to deployments of this version. Given the lack of vendor responsiveness, organizations must prioritize the implementation of compensating controls to mitigate the exposure, as the absence of input validation represents a severe security oversight that could lead to full system compromise depending on the application's underlying service permissions.",
  "technicalDetails": "The vulnerability is identified as a path traversal flaw located in the QuestionnaireService component of Eleveo Quality Management 9.7.0, specifically within the runDataExportNow function. The root cause is the improper validation and sanitization of the 'file_name' parameter supplied during the data export process.\nWhen the runDataExportNow function is invoked, the application takes the user-provided 'file_name' string and utilizes it directly in file system interaction APIs without enforcing directory boundary constraints. An attacker can exploit this by injecting directory traversal sequences, such as '../' (dot-dot-slash) or absolute paths, into the 'file_name' argument.\nThe attack flow proceeds as follows: First, the attacker identifies a reachable endpoint that invokes the QuestionnaireService.runDataExportNow function. Second, the attacker crafts a malicious payload for the 'file_name' parameter, for example, supplying a path such as '../../../../etc/passwd' or other sensitive configuration files. Third, the application's backend processes the request, resolving the traversal sequences against the intended directory structure. Finally, the application executes a read or write operation on the path resolved by the manipulated input.\nThe impact of this exploitation depends on the operating system context and the privileges assigned to the user account running the Eleveo Quality Management service. If the service runs with high privileges, the attacker could achieve arbitrary file read, allowing for the exfiltration of sensitive credentials, system configuration files, or database connections. In some scenarios, depending on how the application handles the file output, this may also facilitate arbitrary file write or overwrite, potentially allowing for remote code execution (RCE) if the attacker can influence executable files or configuration scripts loaded by the application.\nBecause the exploit is publicly available, the barrier to entry for potential attackers is extremely low. The vulnerability is accessible remotely and does not strictly require complex post-exploitation movement, as the direct interaction with the file system provides immediate access to server-side resources."
}