Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T20:16:51.720Z",
  "pubdate": "2026-08-14T20:16:51.720Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The security flaw stems from improper limitation of a pathname to a restricted directory, allowing an unauthorized or improperly constrained traversal sequence.\nThe primary impact of this vulnerability is the potential exposure of sensitive system information, which could be leveraged by an adversary to gain deeper insights into the underlying architecture or facilitate subsequent attacks against the host environment.\nThe vulnerability affects IBM Db2 Mirror for i across the specified major versions. Exploitation requires the attacker to possess remote authenticated access to the target system. Due to the nature of directory traversal vulnerabilities, successful exploitation generally involves manipulating input parameters containing path separation sequences to access files outside the intended restricted directory structure.\nRisk implications include potential data compromise and exposure of internal configuration states. Organizations utilizing the affected IBM Db2 Mirror for i versions should evaluate exposure and apply applicable vendor-supplied updates or compensating controls as soon as they become available.",
  "technicalDetails": "The vulnerability identified in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is classified as an improper limitation of a pathname to a restricted directory, commonly known as a path traversal or directory traversal flaw.\nThe root cause of the vulnerability lies in the insufficient validation, sanitization, or filtering of user-supplied path inputs within the affected component of IBM Db2 Mirror for i. When handling requests that involve file system paths or directory lookups, the application fails to adequately neutralize special characters, such as dot-dot-slash (../) sequences, which allow navigation outside the root directory of the restricted context.\nThe attack vector is network-based, requiring the threat actor to have remote authenticated access to the target environment. An authenticated attacker can craft malicious requests containing directory traversal primitives directed at the vulnerable component. By supplying specially formatted pathnames, the attacker bypasses intended boundary checks and accesses arbitrary files located outside the restricted directory tree, provided the underlying service account possesses the requisite operating system read permissions.\nThe step-by-step attack flow proceeds as follows: First, the remote authenticated attacker establishes communication with the vulnerable IBM Db2 Mirror for i service. Second, the attacker formulates an HTTP request or proprietary protocol payload containing absolute or relative path traversal sequences (e.g., sequences designed to traverse parent directories). Third, the vulnerable component processes the unsanitized input and maps it directly to the underlying file system without enforcing strict boundary constraints. Fourth, the application reads the targeted resource from the restricted directory or adjacent file paths. Finally, the contents of the sensitive file are returned in the response to the attacker, resulting in unauthorized information disclosure.\nThe post-exploitation impact includes the acquisition of sensitive system data, configuration details, or other proprietary files accessible to the service context, which can assist the attacker in mapping the internal environment for further exploitation."
}