Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-14T20:16:50.180Z",
  "pubdate": "2026-08-14T20:16:50.180Z",
  "executiveSummary": "A path traversal vulnerability exists in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 that could allow a remote attacker to write arbitrary files on the underlying file system. The root cause stems from improper limitation of a pathname to a restricted directory, enabling an attacker to bypass boundary restrictions and manipulate file system locations outside the intended operational scope.\nThe impact of successful exploitation includes unauthorized file creation and modification capabilities, which can lead to system compromise, configuration tampering, or the placement of malicious payloads within sensitive directories. This vulnerability poses significant risk implications to confidentiality, integrity, and availability depending on the privileges of the executing context and the target file locations.\nThe attacker capabilities require remote network access to the vulnerable product components. While specific authentication and privilege requirements are dictated by the attack surface exposure of IBM Db2 Mirror for i, the ability to write arbitrary files typically facilitates advanced post-exploitation scenarios, including remote code execution or denial of service through resource exhaustion and file corruption.",
  "technicalDetails": "The vulnerability resides within the pathname parsing and validation logic of IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The root cause is categorized as an improper limitation of a pathname to a restricted directory (Path Traversal), where user-supplied input containing directory traversal sequences (such as dot-dot-slash patterns) is insufficiently sanitized or validated before being processed by file system operations.\nExploitation occurs when an unauthenticated or authenticated remote attacker interacts with vulnerable network services exposed by IBM Db2 Mirror for i. The attacker crafts a specialized request incorporating malicious path traversal sequences within file write parameters or data transfer routines. Because the application fails to adequately enforce boundary restrictions, the underlying operating system resolves the manipulated pathname outside the designated secure repository.\nDuring the attack flow, the attacker submits the crafted payload over the network protocol utilized by the vulnerable component. The vulnerable component processes the input and attempts to write data to the specified destination path. Due to the lack of stringent sanitization, the application writes the payload to an arbitrary location on the file system dictated by the attacker-controlled path traversal sequences.\nThe post-exploitation impact of this arbitrary file write vulnerability is severe. An attacker can overwrite critical system configurations, insert unauthorized binaries into execution paths, or manipulate operational data structures. Depending on the targeted file paths and system permissions, this can escalate to full system compromise or operational disruption of the IBM Db2 Mirror high-availability environment."
}