Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T17:17:24.443Z",
  "pubdate": "2026-08-12T17:17:24.443Z",
  "executiveSummary": "This vulnerability involves a path traversal security flaw affecting IBM i operating system versions 7.6, 7.5, 7.4, and 7.3.\nThe flaw allows a remote authenticated attacker to bypass intended directory restrictions, leading to unauthorized sensitive information disclosure and arbitrary file manipulation.\nThe primary risk implication is the potential compromise of data confidentiality and integrity on the underlying system, as unauthorized entities can access and alter restricted file system resources.\nExploitation of this vulnerability requires the attacker to possess authenticated access to the target system, meaning the threat actor must first establish a valid session or possess legitimate credentials.\nNo specific preconditions beyond remote authentication are detailed, but successful exploitation hinges on the application's failure to adequately sanitize user-supplied input containing directory traversal sequences (such as dot-dot-slash patterns).",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and sanitization of file path parameters within the affected components of IBM i 7.6, 7.5, 7.4, and 7.3.\nWhen an application or service fails to properly neutralize special elements such as directory traversal sequences (e.g., ../), an authenticated remote attacker can supply specially crafted input to navigate outside the intended root directory.\nThe attack flow begins with the adversary authenticating to the target system through an exposed network protocol or interface that interacts with the vulnerable file handling mechanisms.\nThe attacker then submits a malicious payload containing path traversal sequences designed to target specific sensitive files or directories outside the designated operational scope.\nUpon receiving the request, the vulnerable component processes the unsanitized path, resolving the directory traversal sequences and granting access to resources residing outside the intended sandbox or restricted directory.\nPost-exploitation impact includes the acquisition of sensitive information, such as configuration files, system data, or user records, as well as the ability to manipulate files by overwriting or creating arbitrary data within accessible directories.\nThe network exposure depends on the specific services running on the IBM i platform that utilize the vulnerable file processing logic, while the authentication and privilege requirements necessitate that the attacker already holds valid credentials to interact with the vulnerable interface."
}