IBM Guardium Data Protection CVE-2026-4917

Exploitation requires valid administrative credentials and authenticated network access to the Guardium Data Protection web interface. The vulnerability is triggered by sending HTTP requests with maliciously crafted file path parameters containing dot-dot-slash (/../) sequences. No evidence of exploitation without prior authentication or against unauthenticated endpoints. The flaw is specific to Guardium Data Protection 12.1; other versions may or may not be vulnerable. The attack path requires the admin user to submit the specially crafted URL request actively - no mention of passive exploitation, stored payloads, or cross-site request forgery chaining. Non-default configuration does not appear to be a prerequisite; if Guardium 12.1 is deployed with the web interface enabled, the flaw is likely present in standard installations.

This vulnerability presents moderate real-world risk with important contextual limitations. The CVSS score of 4.9 reflects the severity constraints: while the attack vector is network-based (AV:N) and requires no user interaction (UI:N), exploitation mandates high-level administrative privileges (PR:H), significantly reducing the attacker pool. The integrity impact is marked as high (I:H) - files can be written - but confidentiality and availability are unaffected. The SSVC framework assessment would likely classify this as important but not critical: exploitation is possible (PR:H is a known privilege level), but the attacker must already possess administrative credentials, meaning insider threat or prior system compromise is prerequisite. No KEV status, active exploitation reports, or public POC identified in provided data, suggesting this remains primarily a theoretical risk or targeted vulnerability rather than widespread active exploitation. Organizations with strong administrative access controls and privileged account monitoring would have detection opportunities. The combination of high CVSS (4.9) with required admin privilege creates a mismatch where raw score may overstate practical urgency relative to actual threat landscape.

An insider with administrative credentials to Guardium Data Protection discovers the path traversal flaw and crafts a malicious URL request like https://guardium-server/admin/file?path=/../../../etc/passwd to write a backdoor script or configuration file outside the intended application directory. The attacker gains persistence by injecting code into system startup scripts or modifying authentication files. Alternatively, an external attacker first compromises a Guardium admin account through phishing or credential theft, then leverages the path traversal to write webshell or privilege-escalation payloads to sensitive system directories.