CVE-2026-21822 PUBLISHED

A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).

Assigner: HCL
Reserved: 05.01.2026 Published: 18.09.2026 Updated: 18.09.2026

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 6.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	HCL Software
Product	HCL AppScan 360°
Versions	Default: unaffected Version v 2.1.0 and lower is affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133460

Problem Types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE