CVE-2026-21822CWE-22path-traversal

CVE-2026-21822

Medium · published September 18, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-18T13:16Z
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133460 · [email protected]
EPSS history
Timeline
  • 19 SEP 03:51Z
    EPSS moved — → 0%
    epss
  • 18 SEP 08:32Z
    A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).
    cvelistv5