Endpoint Security and HX
CVE-2023-5607: Improper limitation of a path name to a restricted directory (path traversal) in Trellix Application and Change Control (TACC)
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trellix Application and Change Control (TACC) Prior to version 8.4 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.