← Back to the live CVE advisory feed

CVE-2026-75847: ash_paper_trail

Severity

5.9 (MEDIUM)

Vendor

ASH-PROJECT

Affected versions

0.1.1 through before 0.7.0; e379ca90a0c4db54d07a9d1556fd12f2413f6e98 through before 90efdb0769f83f7c5daba6a87758daebf4ba

Fixed version

0.7.0.

Patch status

Patched

Published

2026-08-30T01:20:24.617

Modified

2026-08-30T01:20:24.617

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

View the official NVD record for CVE-2026-75847

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.