Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T18:17:26.313Z",
  "pubdate": "2026-08-12T18:17:26.313Z",
  "executiveSummary": "A path traversal vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3 that allows a remote authenticated attacker to obtain sensitive information.\nThe vulnerability arises from the improper limitation of a pathname to a restricted directory, enabling unauthorized file system access beyond the intended boundaries.\nThe primary impact of successful exploitation is the unauthorized disclosure of sensitive system or application data, potentially compromising the confidentiality of the affected platform.\nThe threat actor must possess authenticated access to the target system to initiate the attack sequence, leveraging valid credentials to interact with vulnerable components.\nRisk implications include the exposure of critical configuration files or proprietary data accessible via the underlying file system, which can be leveraged for further attacks or lateral movement within the environment.\nNo specific preconditions beyond authentication are explicitly detailed in the advisory, making secure credential management and principle of least privilege critical components of defense against this vector.",
  "technicalDetails": "The root cause of the vulnerability is rooted in insufficient input validation and sanitization regarding directory paths supplied to the affected file-handling mechanisms.\nSpecifically, the application or service fails to properly restrict pathnames to designated restricted directories, allowing sequences such as dot-dot-slash (../) to traverse the directory hierarchy.\nThe vulnerable component resides within IBM i 7.6, 7.5, 7.4, and 7.3, handling file retrieval or path resolution tasks for authenticated users.\nThe attack vector requires a remote authenticated attacker who interacts with the vulnerable service by supplying crafted path parameters designed to escape the web root or operational directory restriction.\nDuring the attack flow, the attacker submits an HTTP request or protocol command containing malicious path traversal sequences.\nThe vulnerable component processes the input without adequate boundary checks, resolving the path relative to the root directory of the file system rather than the intended sandbox.\nThis allows the application to access, read, and return the contents of arbitrary files that the underlying process context has permissions to read.\nAuthentication requirements dictate that the attacker must have established valid credentials and an active session or access vector to communicate with the vulnerable service.\nPrivilege requirements are bound to the access rights of the service execution context and the authenticated user role, which dictate which files outside the restricted directory can be successfully read.\nNetwork exposure involves remote accessibility to the service endpoints that interface with the vulnerable path resolution logic.\nThe post-exploitation impact centers on unauthorized information disclosure, where the attacker harvests sensitive configuration data, system files, or user information returned in the response payload."
}