Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-13T20:17:18.003Z",
  "pubdate": "2026-08-13T20:17:18.003Z",
  "executiveSummary": "A path traversal vulnerability has been identified in IBM i versions 7.6, 7.5, 7.4, and 7.3. This security flaw enables a remote authenticated attacker to delete arbitrary files on the underlying filesystem by manipulating input parameters that reference file paths.\nThe vulnerability exposes the system to unauthorized file deletion risks, potentially compromising data integrity and system stability. Successful exploitation requires remote authentication, meaning the threat actor must possess valid credentials to access the vulnerable functionality.\nThe root cause stems from insufficient sanitization of user-supplied input paths, allowing directory traversal sequences (such as dot-dot-slash) to escape intended operational boundaries. Risk implications include the malicious removal of critical system files, application data, or configuration components.\nOrganizations utilizing the affected IBM i operating system versions should implement applicable vendor-supplied patches and restrict user privileges to mitigate the risk of arbitrary file deletion through traversal vectors.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The root cause resides within the input validation mechanisms of the vulnerable component, where user-supplied file path parameters are processed without adequate sanitization or boundary enforcement.\nTo exploit this vulnerability, a remote authenticated attacker crafts a malicious request containing directory traversal sequences, such as relative path notations (e.g., ../), designed to navigate outside the authorized storage directory. Because the application fails to adequately validate or restrict the canonicalized path of the target file, the file system operation processes the manipulated path.\nThe attack flow proceeds as follows: First, the attacker authenticates to the target IBM i system using valid credentials. Second, the attacker interacts with the vulnerable interface or function responsible for file management operations. Third, the attacker submits a specially crafted payload containing traversal sequences directed at a sensitive or arbitrary file location on the system. Fourth, the vulnerable application resolves the path and executes a file deletion routine against the targeted resource outside the intended directory scope.\nThe privileges required for exploitation include remote authentication, though specific administrative privileges may depend on the targeted file's underlying filesystem permissions. Network exposure is present wherever the vulnerable interface is accessible over the network. The resulting payload behavior manifests as the unauthorized removal of files, leading to denial of service conditions, data loss, or corruption of dependent software components."
}