Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-14T20:16:51.487Z",
  "pubdate": "2026-08-14T20:16:51.487Z",
  "executiveSummary": "A path traversal vulnerability exists in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 that could allow a remote authenticated attacker to delete arbitrary files on the underlying filesystem.\nThe vulnerability arises from insufficient input validation and sanitization of file path parameters processed by the affected product.\nAn attacker possessing valid authentication credentials can manipulate file path inputs to traverse directory structures outside the intended operational scope.\nSuccessful exploitation of this flaw grants the capability to target and remove critical system or application files, potentially leading to severe denial of service conditions, system instability, or data loss depending on the file permissions associated with the execution context.\nThe risk implication is critical for environments where strict tenant isolation or least-privilege principles are bypassed due to inadequate path normalization.\nRemediation requires applying the official vendor-supplied patches or updates corresponding to the affected versions of IBM Db2 Mirror for i.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw, occurring within IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6.\nThe root cause stems from the application's failure to adequately sanitize, validate, or canonicalize user-supplied file paths before performing file deletion operations.\nSpecifically, the vulnerable component accepts input containing directory traversal sequences, such as dot-dot-slash (../) patterns, allowing the logic to break out of the designated root directory and access arbitrary locations on the filesystem.\nExploitation requires the attacker to be authenticated to the system, interacting with the vulnerable interface exposed over the network.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious request targeting the file management or synchronization functions of IBM Db2 Mirror for i. Within this request, the file path parameter is injected with path traversal sequences designed to navigate to sensitive directories outside the intended operational boundaries. Second, the backend application processes the unsanitized input and resolves the absolute path without enforcing boundary checks. Third, the system executes a file deletion API or system command using the resolved path. Finally, the targeted arbitrary file is deleted from the filesystem, contingent upon the file permissions granted to the process handling the request.\nThe post-exploitation impact includes unauthorized deletion of critical operating system files, database configuration files, or operational logs, resulting in integrity degradation and system-wide service disruption."
}