Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T21:17:35.027Z",
  "pubdate": "2026-08-12T21:17:35.027Z",
  "executiveSummary": "IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain a path traversal vulnerability specifically characterized as a Zip Slip issue during the configuration import process. This security flaw allows malicious actors to manipulate archive file paths, enabling the writing of arbitrary files to the underlying file system outside of the intended extraction directory. The vulnerability poses significant risk implications, including potential arbitrary file overwrite or creation depending on the privileges of the user executing the application. Successful exploitation requires an attacker to deliver a specially crafted configuration archive containing directory traversal sequences (such as dot-dot-slash) to a victim who subsequently initiates the import procedure within the affected software. The impact compromises file system integrity and can potentially lead to further system compromise or local privilege escalation vectors if critical system files or binaries are targeted during the extraction phase.",
  "technicalDetails": "The vulnerability resides within the archive extraction and configuration import mechanism of IBM i Access Client Solutions, specifically affecting versions 1.1.2.0 through 1.1.9.13. The root cause of the flaw stems from insufficient input validation and sanitization of file paths contained within compressed archive headers during the parsing and extraction phases. When the application processes an imported configuration file packaged as a ZIP archive, it extracts the contained entries to the target directory without adequately verifying whether the destination path resolves outside the intended base directory boundary.\nExploitation of this vulnerability occurs when an attacker crafts a malicious ZIP archive containing file entries with relative path traversal sequences, such as '../', in the filename fields. When a user initiates the import of this crafted configuration via the client interface, the vulnerable component iterates through the archive entries and passes the unsanitized paths directly to the file system APIs. Consequently, the archive extraction routine resolves the traversal sequences, allowing files to be written to arbitrary locations on the host file system.\nThe attack flow requires an adversary to construct the malicious archive, distribute it to the target user or system through social engineering or other delivery mechanisms, and trick or induce the user to import the configuration through the IBM i Access Client Solutions application. No network exposure or authentication is inherently required by the vulnerability itself beyond the user interaction necessary to trigger the configuration import process. The execution privileges of the resulting file write operations correspond directly to the permission context of the user running the client software, which may lead to the overwriting of application binaries, configuration files, or user data, thereby facilitating further post-exploitation activities."
}