Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T17:17:25.120Z",
  "pubdate": "2026-08-12T17:17:25.120Z",
  "executiveSummary": "A path traversal vulnerability has been identified in IBM i versions 7.6, 7.5, 7.4, and 7.3, which could allow a remote authenticated attacker to obtain sensitive information.\nThe vulnerability stems from improper validation of user-supplied path input within the affected systems.\nSuccessful exploitation of this security flaw grants an attacker unauthorized read access to confidential files and directory structures that should otherwise be restricted based on standard access control configurations.\nThe primary impact of this vulnerability is unauthorized information disclosure, potentially exposing system configuration data, sensitive user files, or internal application structures.\nExploitation requires a remote attacker to possess valid authentication credentials to interact with the vulnerable application or service interface.\nThe attack vector involves manipulating path inputs to bypass directory restriction controls enforced by the application.\nOrganizations operating the specified versions of IBM i face heightened risk if attackers leverage compromised low-privileged accounts to harvest sensitive system data, which can subsequently be utilized to plan further intrusions or escalate privileges.",
  "technicalDetails": "The vulnerability resides in how IBM i versions 7.6, 7.5, 7.4, and 7.3 process user-supplied path inputs across specific application interfaces or components.\nThe root cause of the issue is the insufficient sanitization and validation of parameters containing directory traversal sequences, such as dot-dot-slash (../) sequences, prior to performing file system operations.\nBecause the application fails to adequately neutralize these metacharacters, an authenticated user can manipulate file paths outside of the intended directory context.\nThe attack flow begins when a remote authenticated adversary crafts a malicious HTTP request or protocol command containing directory traversal sequences within a targeted parameter.\nUpon submission, the vulnerable component processes the input without enforcing strict boundary checks or canonicalization of the provided path string.\nThe underlying operating system or application logic resolves the manipulated path, allowing the attacker to traverse upward in the directory hierarchy and access arbitrary files accessible to the execution context of the running service.\nThe attack requires authentication, meaning the threat actor must first establish a valid session or possess legitimate credentials to access the vulnerable functionality.\nNetwork exposure depends on the specific service interfaces exposed by IBM i that handle user-supplied paths, which are typically reachable over standard administrative or application communication ports.\nThe post-exploitation impact is characterized by unauthorized information disclosure, where the attacker extracts sensitive system files, configuration settings, or internal data stores, thereby compromising the confidentiality of the affected IBM i environment."
}