Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T19:17:16.407Z",
  "pubdate": "2026-09-14T19:17:16.407Z",
  "executiveSummary": "This vulnerability involves an improper authorization or security constraint enforcement mechanism within IBM i Navigator for i. The issue allows a remote authenticated attacker to bypass file upload restrictions, enabling the placement of files into the system's file structure that are otherwise prohibited by current Navigator configurations.\nThe vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6. While the vulnerability facilitates unauthorized file placement, the impact is gated by the attacker's existing system permissions; the exploit succeeds only if the authenticated user profile possesses sufficient authority to perform the file operations independently of the Navigator interface.\nThe risk is primarily centered on potential privilege escalation or lateral movement within the file system, as the bypass facilitates the delivery of arbitrary files to unintended directory locations. Because exploitation requires prior authentication, the threat is categorized as a post-authentication authorization bypass. No specific exploit code or public PoC is required for conceptualization, as the flaw resides in the logic governing Navigator’s interaction with the underlying file system's access control lists (ACLs) and authority structures.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic failure within the Navigator for i component responsible for enforcing security policies on file system operations. Specifically, the component fails to correctly validate or apply configured restrictions when processing file upload requests through the web-based Navigator interface. Instead of adhering strictly to the security policy defined within Navigator, the application allows operations that should have been intercepted and blocked by the administrative configuration.\nThe vulnerability manifests as an authorization bypass where the application’s intended security boundary is circumvented. Under normal conditions, Navigator for i should validate that a user's action complies with established file system constraints. However, due to the flaw, an authenticated attacker can perform file write or upload operations that would otherwise be rejected by the interface. It is important to note that the vulnerability does not bypass the underlying operating system's object-level security. If the user profile lacks the necessary authority (e.g., *RWX permissions) to write to the target directory at the OS level, the operation will fail despite the bypass.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate, authenticated session with the IBM i system via the Navigator for i interface. Second, the attacker initiates a file upload request directed at a restricted path that is supposed to be blocked by the Navigator configuration. Third, the Navigator component fails to enforce the restriction logic, allowing the request to be passed to the underlying IBM i file system services. Fourth, the file is successfully written to the destination, provided the user's OS-level profile maintains sufficient permissions to perform the write operation. Finally, if successful, the attacker may use this placement to stage malicious scripts, overwrite critical configuration files, or deploy payloads that could be executed by other processes or users, thereby facilitating further system compromise.\nThe vulnerability is limited to the Navigator for i component's handling of user input and does not imply a complete failure of the IBM i security model, as the operating system’s native authority checking mechanism remains an active defense layer. However, the bypass allows for unauthorized administrative activity that deviates from the desired operational security policy."
}