CVE-2023-28127: Ivanti Avalanche getLogFile path traversal information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable path traversal with high confidentiality impact and very high EPSS score, though no confirmed in-the-wild exploitation is documented.

What it is

Ivanti Avalanche 6.3.x and below contains a path traversal flaw (CWE-22) in the getLogFile function, allowing crafted paths to reach files outside the intended log directory. Successful exploitation results in information disclosure, which matters because exposed files may contain sensitive configuration or credential data.

Impact

An attacker gains read access to files outside the intended directory, leading to disclosure of potentially sensitive information. The CVSS vector confirms high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network via the getLogFile functionality, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not specify the exact endpoint or parameter, so defenders should treat any log-retrieval interface as the entry point.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record, but EPSS is 0.586 (99th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Upgrade Ivanti Avalanche to a version above 6.3.x as directed by the vendor advisory.
• Restrict network access to Avalanche management and log-retrieval interfaces to trusted hosts only.
• Validate and canonicalize file paths in log-retrieval functions, rejecting traversal sequences and absolute paths.
• Run the Avalanche service with least privilege so disclosed files are limited to non-sensitive data.
• Monitor vendor advisory for updated fixed versions and interim guidance.

Detection

• Review Avalanche logs for getLogFile requests containing traversal sequences such as ../ or encoded variants.
• Alert on HTTP requests to log-retrieval endpoints with absolute or unusual file paths.
• Monitor for outbound reads of configuration or credential files by the Avalanche service account.
• Correlate unexpected file access patterns on the Avalanche host with external request sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.