Description

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-12T17:17:23.993Z",
  "pubdate": "2026-08-12T17:17:23.993Z",
  "executiveSummary": "This vulnerability is classified as a stored cross-site scripting (XSS) security flaw affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The security defect allows an authenticated user to successfully inject and store arbitrary JavaScript payloads within the Web UI application. Upon rendering, the malicious script executes within the context of other users' active browser sessions. The primary impact of successful exploitation includes the potential disclosure of sensitive session credentials and the unauthorized alteration of intended Web UI functionality within a trusted session context. The vulnerability requires prior user authentication to the Web UI and leverages the capability of the authenticated attacker to input and persist malicious script data into application storage mechanisms. The risk implication centers on session hijacking, unauthorized actions performed on behalf of victim users, and the compromise of user data confidentiality and integrity across trusted administrative or standard user boundaries.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and output encoding within the Web UI component of IBM i versions 7.6, 7.5, 7.4, and 7.3. When handling user-supplied data intended for persistent storage, the application fails to properly neutralize executable script tags or special characters that define HTML and JavaScript contexts. Consequently, malicious input provided by an authenticated user is stored directly within the application's backend database or storage mechanism without adequate neutralization.\nExploitation of this stored XSS vulnerability requires the attacker to possess authenticated access to the vulnerable Web UI of IBM i. The attack flow begins when the authenticated attacker crafts a malicious payload containing arbitrary JavaScript code and submits it through input vectors exposed by the Web UI, such as configuration fields, user profiles, or data entry forms. The application accepts the input and persists it into the server-side storage without enforcing strict validation or context-aware output encoding rules.\nAt a later stage, when a victim user navigates to the affected section of the Web UI, the application retrieves the stored malicious payload from the backend storage and renders it directly into the victim's browser DOM without proper sanitization. The browser interprets the injected data as legitimate executable code and executes the arbitrary JavaScript within the security context of the victim's trusted session.\nThe payload behavior during post-exploitation leverages the trust relationship established between the victim's browser and the IBM i Web UI. Because the script executes inside the active session, it can access Document Object Model (DOM) elements, interact with application programming interfaces, read sensitive data including session tokens or cookies, and perform unauthorized actions on behalf of the victim user. This leads directly to potential credential disclosure and session compromise."
}