InfoSphere Optim TDF CVE-2026-3366

No special conditions - remote unauthenticated exploitation of IBM InfoSphere Optim Test Data Fabrication's web request handling (CVSS AV:N/AC:L/PR:N/UI:N), requiring only network reachability to the vulnerable service and a URL containing '../' traversal sequences. The principal limiting factors are: exploitation only discloses readable files (C:H, I:N/A:N) and cannot modify or crash the system; the attacker must have a network path to the service (so the impact is sharply reduced when the interface is not internet-exposed); the affected build must be one of versions 1.0.0 through 1.0.2.7; and what an attacker can actually read is bounded by the OS-level permissions of the account running the service.

The signals are partially conflicting and warrant a measured priority. CVSS 7.5 is driven entirely by high confidentiality impact (C:H) over a network vector with low complexity and no privileges (AV:N/AC:L/PR:N/UI:N) - meaning easy, unauthenticated reachability - but integrity and availability are untouched (I:N/A:N), so this is read-only file disclosure rather than code execution or tampering. CISA's SSVC assessment lists Exploitation: none (no observed or public exploitation), Automatable: yes (the traversal can be scripted/sprayed at scale), and Technical Impact: partial (consistent with disclosure-only). This is not in CISA KEV and no proof-of-concept is referenced, so no public exploit identified at time of analysis. Net: a genuine but bounded risk - realistic as an opportunistic, automatable scanner target that could leak configuration files, credentials, or source paths, yet lower urgency than an RCE because it cannot directly alter or crash the system. The EUVD affected-version notation ('...1.0.2.7 ≤1.8.4') is ambiguous and appears malformed; the authoritative version list is the enumerated 1.0.0-1.0.2.7 from IBM/NVD, and the upper bound should be verified against the IBM advisory.

An attacker who can reach the Optim TDF web service sends a single crafted HTTP request with a path parameter such as '/..%2f..%2f..%2fetc%2fpasswd' (or a Windows equivalent) to read files outside the intended directory. With no authentication required, they retrieve sensitive content - application configuration, connection strings, or credential files - which can be looted at scale since the technique is automatable, then reused to pivot deeper. No public proof-of-concept is referenced, but the attack is simple to reproduce given the well-understood traversal class.