EUVD-2026-97897
GHSA-fr6x-p4fr-jfmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Maximo web endpoint over network
-
DeliverySend crafted URL with /../ sequences
-
ExploitTraverse outside intended web root
-
ExecutionRead arbitrary system files
-
ImpactHarvest disclosed credentials/config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation is possible against IBM Maximo Application Suite (versions 8.10, 8.11, 9.0, 9.1, 9.2) per the CVSS vector (AV:N/PR:N/UI:N). The only prerequisite is HTTP(S) access to the application's web interface, so the primary limiting factor is network exposure: instances behind a WAF, reverse proxy with path normalization, or restricted to internal/VPN networks are substantially harder to reach. Impact is bounded to file disclosure (C:H, I:N, A:N) and further limited by OS-level file permissions of the account running the Maximo web process - only files that account can read are exposed. |
| Impact | Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, which is the easy end of the exploitability spectrum; the 7.5 score is driven entirely by confidentiality (C:H) with no integrity or availability impact (I:N/A:N), consistent with a read-only directory traversal (CWE-22). However, several real-risk amplifiers are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or imminent exploitation. No SSVC decision data (exploitation/automatable/technical impact) is provided either. Net assessment: this is a credible, easily-exploitable information-disclosure issue in enterprise software and should be patched promptly, but on current data it is a routine high-severity file-read bug rather than an emergency - treat as high-CVSS with no confirmed real-world exploitation yet. Note the one caveat to verify: directory traversal severity depends heavily on what the web/app user can read (config files, credentials, keys); C:H assumes sensitive files are reachable, which should be confirmed against the deployment. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP(S) URL containing '../' (dot-dot-slash) sequences to a Maximo Application Suite endpoint to escape the intended web root and read arbitrary files on the server, such as configuration files, credentials, or application source. No public exploit code is identified at time of analysis, but the technique is trivial and well-understood, requiring only a browser or curl. Successful reads could disclose secrets usable to pivot deeper into the environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Path traversal in IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1 and 9.2 lets remote, unauthenticated attackers read arbitrary files from the server by sending crafted URL requests containing '../' sequences. The flaw carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no data modification or denial of service, and the independent assessment rates the overall signal as moderate and internally consistent rather than alarming. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; practical exposure depends mainly on internet reachability and on the OS-level file permissions of the account running the Maximo web process, since only files that account can read are disclosed.
RemediationAI
No patch version or fix level is specified in the provided source data, so the IBM advisory at https://www.ibm.com/support/pages/node/7290791 should be treated as the authoritative source for the remediating release and any interim guidance; apply the latest available fix for the deployed 8.10, 8.11, 9.0, 9.1 or 9.2 branch rather than assuming a specific version. Until a fixed build is confirmed, the highest-value compensating controls are to place the application behind a reverse proxy or WAF that performs path normalization and rejects or blocks requests containing traversal sequences such as '../' or encoded variants (trade-off: normalization rules can break legitimate clients that rely on encoded or unusual paths and may generate false positives requiring tuning); to restrict network reachability of the Maximo web interface to internal networks or VPN rather than the public internet (trade-off: reduced accessibility for legitimate remote users); and to run the Maximo web process under a least-privilege OS account whose read permissions exclude configuration files, credentials and other sensitive paths, which directly caps the blast radius of any successful traversal (trade-off: tightening the account's file permissions can break features that rely on broader read access and requires testing). Because the flaw requires no authentication, disabling any unnecessary file-serving or document-retrieval endpoints that accept user-supplied paths is also worthwhile, but note these are mitigations only and do not substitute for applying IBM's fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22, improper limitation of a pathname to a restricted directory ('path traversal'): the Maximo web layer accepts user-controlled path components in HTTP requests and passes them toward file-system operations without adequate canonicalization and containment checks, so '../' sequences escape the intended directory and resolve to arbitrary files. The CVSS vector confirms the exploitation profile - network reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N) - meaning any HTTP(S) client that can reach the application's web interface can attempt the attack, with network exposure and any path normalization performed by an interstitial WAF or reverse proxy being the only meaningful gating factors. Scope is unchanged (S:U) and only confidentiality is affected (C:H/I:N/A:N), which is consistent with a file-read primitive rather than remote code execution or data tampering. No CPE strings were provided in the source data; IBM enumerates the affected editions as Maximo Application Suite 8.10, 8.11, 9.0, 9.1 and 9.2, and the sole reference is IBM's advisory at https://www.ibm.com/support/pages/node/7290791.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remotely reachable, low-complexity, unauthenticated traversal with no user interaction; read-only file disclosure gives C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Executive ViewAI
IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2 are affected by a high-severity path traversal vulnerability that allows remote, unauthenticated attackers to read arbitrary files on the server. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but because the flaw can expose configuration files, credentials, or other sensitive data held by the Maximo web process, leadership should treat it as a potential confidentiality and compliance risk. Exposure is highest where Maximo is internet-accessible or runs with broad file permissions.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to Maximo 8.10, 8.11, 9.0, 9.1, and 9.2 instances, blocking traversal patterns at WAF/IPS, running the Maximo web process with least-privilege file permissions, monitoring for '../' requests, and engaging IBM support for an official fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB