IBM Content Navigator CVE-2025-27906

Exploitation requires that the affected IBM Content Navigator application (versions 3.0.11, 3.0.15, 3.1.0, 3.2.0) serve directory listings when an application URL is requested - i.e., directory browsing/indexing is exposed by the deployment. No authentication or user interaction is needed (PR:N/UI:N), and it works over the network against the exposed web application. The key LIMITING factor is impact scope: only file and folder names are exposed; file contents cannot be read, obtained, or modified, so this yields reconnaissance value rather than data theft. Risk is further bounded where the Content Navigator instance is not internet-exposed or where a fronting web server/reverse proxy suppresses directory indexing.

This is a low-to-moderate priority issue, not an urgent one. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) indicates remote, network-based, low-complexity, unauthenticated exploitation but with only LOW confidentiality impact and no integrity or availability impact - consistent with a directory-listing exposure (CWE-548) that reveals file/folder names but, per IBM's own description, not file contents. The EPSS score of 0.31% (21st percentile) is low, reflecting minimal predicted real-world exploitation activity. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. The signals are internally consistent: a genuine but limited information-disclosure weakness useful mainly for reconnaissance rather than direct compromise. The impact scope is a notable nuance - the description explicitly states contents cannot be read, obtained, or modified, so the C:L rating captures exposure of structure/metadata only, which slightly overstates practical confidentiality harm.

An unauthenticated remote attacker browses to an application URL on an affected IBM Content Navigator instance (3.0.11, 3.0.15, 3.1.0, or 3.2.0) and receives a directory listing exposing application files and folder names in the browser. The attacker uses this structural reconnaissance to map the application layout and inform follow-on targeting, though the file contents themselves cannot be read or modified. No public proof-of-concept exploit was identified at the time of analysis.