EUVD-2026-58769
GHSA-mg6v-56c4-fxpj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable deletion requires only low-privilege credentials; no confidentiality impact because the description confirms only file deletion, not file reading.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
AnalysisAI
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attackers holding only low-privileged credentials, exploiting a path traversal flaw that bypasses directory boundary enforcement to reference and delete files anywhere on the target filesystem. The CVSS 3.1 score of 8.1 reflects high integrity and availability impact with low attack complexity, though the EPSS score of 0.44% at the 37th percentile signals limited observed exploitation probability at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged authenticated session on the IBM Db2 Mirror for i system, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 High score is primarily driven by the high integrity (I:H) and availability (A:H) impacts - the ability to delete arbitrary files can destroy database files, configuration, or operating system components critical to IBM i operation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided patch referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7283359. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems running IBM Db2 Mirror for i versions 7.4, 7.5, or 7.6 in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Db2 Mirror For I
View allOS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today