IBM i CVE-2026-18106

Exploitation requires a valid authenticated IBM i user account, confirmed by the CVSS vector metric PR:L (low privileges required) - unauthenticated exploitation is not possible. The attacker must be able to submit user-controlled path input to a vulnerable IBM i service over the network (AV:N), and no user interaction from a third party is needed (UI:N). All four supported release lines - 7.3, 7.4, 7.5, and 7.6 - are affected. The specific service, interface, or configuration enabling the path traversal is not identified in the available data beyond what is implied by the CWE-22 classification. Key limiting factors: authentication is mandatory, impact is read-only (no write or denial-of-service capability), scope does not change (no lateral pivot to adjacent systems), and IBM i platforms are typically deployed in network-segregated enterprise environments rather than exposed directly to the internet.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects a meaningfully bounded risk: the attack vector is network (AV:N) with low complexity (AC:L), but a prerequisite of authenticated access (PR:L) substantially narrows the realistic attack surface to credential-holding users. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence. No EPSS score was supplied in the available intelligence; given the authenticated-only vector and absence of a KEV listing or public exploit, real-world exploitation probability is expected to be low-to-moderate - this is not a fire-drill vulnerability. Even a mid-sized municipal IT team in swidnica managing IBM i infrastructure should treat this as a standard patch cycle item rather than an emergency escalation. The primary threat model is an insider or compromised-credential scenario in which a legitimate user leverages path traversal to enumerate or exfiltrate files beyond their authorized scope. The absence of scope change (S:U) and zero integrity/availability impact means successful exploitation cannot be directly parlayed into system compromise or service disruption. No CISA KEV listing and no public proof-of-concept code were identified, reinforcing low urgency for organizations with controlled authenticated access.

An attacker holding valid IBM i user credentials submits a crafted request containing path traversal sequences (such as '../../etc/sensitive-config') to a vulnerable IBM i service endpoint. The platform resolves the unsanitized path against the filesystem, returning the contents of a file outside the user's authorized directory. No public proof-of-concept code has been identified, but the attack pattern is well-understood given the straightforward CWE-22 classification.