Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-13T20:17:16.533Z",
  "pubdate": "2026-08-13T20:17:16.533Z",
  "executiveSummary": "This vulnerability involves an improper validation flaw affecting the IBM i operating system across multiple versions, specifically IBM i 7.6, 7.5, 7.4, and 7.3. The security defect allows a local authenticated threat actor to manipulate file path parameters, leading to unauthorized modification of file ownership for arbitrary files within the filesystem. The impact of this security deficiency is significant, as improper file ownership manipulation frequently serves as a foundational primitive for privilege escalation, unauthorized data access, or system integrity compromise. Exploitation of this vulnerability requires local authentication, meaning an adversary must already possess valid credentials and interactive or programmatic access to the underlying system. No specialized network exposure or remote execution vectors are associated with this flaw, restricting the threat landscape strictly to local users. Risk implications center around the potential for internal threat actors or compromised low-privileged accounts to elevate their standing, modify critical system files, or bypass access control mechanisms by assuming ownership of sensitive system components. Remediation requires applying official vendor patches or updates provided by IBM to resolve the path validation weakness.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper validation of attacker-controlled file paths within privileged routines or system utilities on the IBM i platform. When users supply path arguments to the vulnerable component, the application fails to properly sanitize, canonicalize, or restrict the input against intended boundaries. This validation failure allows an adversary to specify arbitrary file paths rather than restricting operations to authorized directories or files.\nThe affected components are the system functions handling file ownership modifications within IBM i 7.6, 7.5, 7.4, and 7.3. The vulnerability requires local authentication and specific local access privileges, though the exact privilege level depends on the local context required to invoke the vulnerable utility. The attack vector is strictly local; network exposure is not a prerequisite for successful exploitation.\nThe step-by-step attack flow proceeds as follows: First, the local authenticated attacker establishes a session on the target IBM i system. Second, the attacker identifies a vulnerable interface or command that accepts file path inputs for ownership modification operations. Third, the attacker crafts a malicious input payload containing an arbitrary file path—such as a critical system binary, configuration file, or sensitive data store—bypassing intended application logic due to the lack of stringent path validation. Fourth, the vulnerable routine processes the attacker-controlled path without adequately verifying whether the user possesses legitimate administrative jurisdiction over the target resource. Finally, the system executes the ownership change operation, successfully transferring ownership of the arbitrary file to the attacker-controlled account or a designated user profile.\nPost-exploitation impact includes the ability to subvert standard Discretionary Access Control (DAC) mechanisms. By acquiring ownership of arbitrary files, the attacker can subsequently modify file permissions, read confidential data, or replace critical binaries with malicious payloads, setting the stage for persistent system compromise or further privilege escalation."
}