CVE-2026-21822

MediumCVSS 6.3/10Last modified Sep 18, 2026

Description

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HCL SoftwareHCL AppScan 360°v 2.1.0 and lower

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-218248.8HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and perforCVE-2026-218256.1HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could CVE-2026-218266.1HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the HosCVE-2026-218273.1HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2026-21839.8A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73.CVE-2026-218303.7HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or nonCVE-2026-218324.3HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may bCVE-2026-218333.7HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps preventCVE-2026-218343.1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responCVE-2026-218366.5The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, document level access restrCVE-2026-218378.8HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arCVE-2026-21849.8A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerab