Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T20:17:16.667Z",
  "pubdate": "2026-08-13T20:17:16.667Z",
  "executiveSummary": "A path traversal vulnerability has been identified in IBM i versions 7.3, 7.4, 7.5, and 7.6, which could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects.\nThe vulnerability exposes sensitive system resources and compromises data confidentiality and integrity by permitting unauthorized traversal outside of restricted directory structures.\nAffected products include IBM i operating system versions 7.3, 7.4, 7.5, and 7.6.\nThe risk implications are significant, as successful exploitation enables threat actors to bypass intended access controls and interact with files or system objects normally restricted by security policies.\nThe attack vector requires the adversary to possess remote authentication credentials, indicating that an attacker must first establish a valid authenticated session before attempting to exploit the path traversal flaw.\nNo specific user interaction or complex exploitation requirements are detailed beyond the prerequisite of remote authentication.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization of user-supplied path parameters within vulnerable components of IBM i 7.3, 7.4, 7.5, and 7.6.\nWhen an authenticated user supplies specially crafted input containing directory traversal sequences (such as dot-dot-slash patterns), the underlying application or file handling mechanism fails to properly neutralize these sequences.\nThis failure allows the adversary to break out of the intended root directory or object container and traverse the hierarchical file system or system object space.\nThe attack flow begins with the remote authenticated attacker establishing a session against the target IBM i system using valid credentials.\nThe attacker then submits a malicious request containing a path traversal payload designed to reference arbitrary objects outside the permitted execution or access context.\nUpon receiving the request, the vulnerable component processes the unsanitized path and resolves the location to sensitive system objects or files that the attacker should not normally be able to access.\nPost-exploitation impact includes unauthorized read or potentially write access to arbitrary objects, leading to potential information disclosure, exposure of sensitive configuration data, or further compromise of system integrity depending on the permissions associated with the exploited context.\nNetwork exposure is present via the remote attack vector, and the vulnerability specifically requires authentication privileges, meaning anonymous unauthenticated attackers cannot directly exploit this flaw without first obtaining valid user credentials."
}