CVE-2026-85409: falha de média gravidade em Eleveo Quality Management
Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.5%
A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file_name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Eleveo · Quality ManagementPoCs públicas encontradas — 2
cve_referencegithub.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-85409não verificadocve_referencedrive.google.com/file/d/1fCPpqzYyoII_lfC6iXy-hLd1YpJcgmgR/view?usp=sharingnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Eleveo Quality Management
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85407MEDIUMEleveo Quality Management Conversation events denial of serviceEPSS 0.5%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.4%CVE-2026-101142MEDIUMEleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversalEPSS 0.3%CVE-2026-85406MEDIUMEleveo Quality Management Conversation Review cross site scriptingEPSS 0.3%CVE-2026-101146MEDIUMEleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosureEPSS 0.3%CVE-2026-101143MEDIUMEleveo Quality Management QMBODownload information disclosureEPSS 0.3%