EUVD-2025-210936
GHSA-jr48-8c9j-r4v6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Cloud Pak for Data instance
-
DeliverySend crafted URL with ../ sequences
-
ExploitServer resolves path outside web root
-
ExecutionRead arbitrary system files
-
ImpactHarvest sensitive data/credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a Cloud Pak for Data 5.1.2 web endpoint that processes the crafted URL; per CVSS PR:N/UI:N no authentication or user interaction is needed, so an internet- or network-exposed instance can be attacked directly. The primary limiting factor is exposure and version: only 5.1.2 is named as affected, and impact is read-only file disclosure (C:H, I:N/A:N) - no code execution or modification. Deployments behind network segmentation, WAF path-normalization, or already patched to the fixed release are not exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward remote, unauthenticated, low-complexity path-traversal enabling arbitrary file read (C:H, no integrity or availability impact). The signals do not indicate active or imminent mass exploitation: there is no CISA KEV listing, no EPSS score provided, and no public POC referenced - so the correct characterization is 'no public exploit identified at time of analysis.' The single vendor reference is IBM's own support/patch page, meaning affected version and fix are vendor-confirmed but no independent exploitation telemetry exists. Net assessment: a genuinely serious file-disclosure bug on paper (unauth C:H) that in practice is bounded by the low real-world deployment footprint of Cloud Pak for Data and the absence of any exploitation evidence - treat as a should-patch item, not an emergency, unless the specific instance is internet-exposed. The pure C:H with I:N/A:N is consistent with read-only traversal; nothing in the data conflicts with the vector. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted HTTP URL containing '../' dot-dot sequences to a network-reachable Cloud Pak for Data 5.1.2 endpoint, causing the server to return files outside the intended web root (e.g., configuration files, credentials, or tokens). No public exploit code is referenced, but the technique is trivial and well-understood, so exploitation is low-effort once an exposed instance is located. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Path traversal in IBM Cloud Pak for Data 5.1.2 lets remote, unauthenticated attackers read arbitrary files from the server filesystem by sending crafted URL requests containing ../ (dot-dot-slash) sequences. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward, low-complexity information-disclosure issue with high confidentiality impact but no integrity or availability impact; no public exploit code was identified at time of analysis. Only version 5.1.2 is named as affected, and IBM has published a vendor fix, so exposure is limited to unpatched, network-reachable deployments of that release.
RemediationAI
Apply the vendor fix referenced in IBM's security bulletin at https://www.ibm.com/support/pages/node/7287141 - IBM states a patch is available, so treat upgrading Cloud Pak for Data off 5.1.2 to the fixed build as the primary and definitive remediation, and redeploy/patch every service pod in the cluster rather than a single node. If immediate upgrade is not possible, compensating controls include placing a reverse proxy or WAF in front of the Cloud Pak web endpoints with URL path-normalization and dot-dot-slash rejection rules enabled (trade-off: WAF rules can be bypassed with encoding tricks and add request latency, so they are a stopgap, not a substitute for the patch); restricting network reachability to the Cloud Pak management and application endpoints via firewall/security-group rules or OpenShift network policies so only trusted administrative networks can reach them (trade-off: this can break legitimate user and API access for remote or partner-integrated consumers); and running the affected services under a least-privilege container security context with read-only root filesystems and no mounted secrets beyond those strictly required, which limits what files a successful traversal can expose (trade-off: requires validating that the application still functions with reduced filesystem and secret access). Monitor web access logs for requests containing ../ or encoded equivalents (%2e%2e%2f, ..%2f, %252e%252e%252f) against Cloud Pak endpoints as a detection signal, and rotate any credentials or tokens stored in files that sit within the readable scope of the affected service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory (path traversal) in IBM Cloud Pak for Data 5.1.2, a containerized data-and-AI platform built on OpenShift/Kubernetes. An application endpoint accepts a user-supplied path component and resolves it without proper canonicalization, so an injected /../ sequence escapes the intended base directory and the request is served files from locations outside it. Because the traversal is driven entirely by the request URI, the exploited component is a network-facing web endpoint; the underlying technology is a Java-based enterprise application server stack typical of Cloud Pak services. The CPE entry cpe:2.3:a:ibm:cloud_pak_for_data:*:*:*:*:*:*:*:* covers the product family, with the EUVD record (EUVD-2025-210936) narrowing the affected release to 5.1.2. Read access is granted only at the privilege level of the affected service process, which in typical containerized deployments can still expose configuration files, connection strings, service credentials, and mounted secrets reachable by that process - hence the C:H rating with S:U (impact confined to the vulnerable component's security scope).
Know when Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated URL request (AV:N/AC:L/PR:N/UI:N) yields arbitrary file read (C:H) with no write or availability impact (I:N/A:N), scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Executive ViewAI
IBM Cloud Pak for Data 5.1.2, an analytics and AI platform commonly used to store and process sensitive enterprise data, can be made to disclose arbitrary files from its host filesystem to any network user without credentials. Because the platform often houses configuration files, connection strings, and credentials for downstream data sources, a single successful read could expose material that undermines the security of the wider data estate. Leadership should care because the vulnerable interface is remotely reachable and requires no authentication, placing the burden of protection entirely on patching and network controls rather than on user behavior.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Cloud Pak For Data
View allAuthenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitr
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read fil
IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. Rated high severity (CVSS 7.5)
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attack
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attack
IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a
IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additio
IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS
IBM Cloud Pak for Data 2.5 could allow a local user with special privileges to obtain highly sensitive information. Rate
Exploit-DB