Code for IBM i CVE-2026-49484

Exploitation requires a shared multi-user host where the /tmp directory is readable by other local accounts (default on many Unix/Linux systems, which use world-readable /tmp), AND requires the legitimate developer to have performed an Object Browser download or edit-save operation in Code for IBM i versions prior to 3.0.1, leaving content that is not reliably cleaned up. Limiting factors: the attacker must already possess a separate local account on the same machine (not remotely exploitable despite the AV:N label); the issue is not exploitable on single-user workstations or on systems that enforce per-user private temp directories or restrictive /tmp permissions; and only versions before 3.0.1 are affected.

This is a low-to-medium real-world risk issue best characterized as local information disclosure via insecure temporary file handling (CWE-377). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) conflicts with the description: the vulnerability requires that '/tmp is accessible to other local accounts' and that file contents 'remain readable' to other local users, which is inherently a LOCAL attack vector - the AV:N (Network) designation appears incorrect and should be verified, as there is no network-reachable component described. No EPSS score, KEV listing, or public POC was provided, so exploitation probability signals are absent rather than low; the exploitation status is 'no public exploit identified at time of analysis.' The impact metrics in the input (VC:L/VI:L/VA:L and subsequent-system SC:L/SI:L/SA:L) also look overstated for what is fundamentally a read-only disclosure of residual files - confidentiality is the real impact, while integrity and availability effects are marginal at best. Realistically this is a hygiene/hardening defect exploitable only on shared multi-user hosts, not an urgent remote-code-execution priority; prioritize patching for shared developer servers but it is low priority on single-user workstations.

On a shared Linux/Unix host where multiple IBM i developers log in and /tmp is world-readable, a developer uses the Code for IBM i extension's Object Browser to download or edit-and-save a source member or object, leaving the content in /tmp without cleanup. A second local user on the same machine then reads those leftover /tmp files, exposing potentially sensitive source code or object data. No public exploit code is required - the attack is simply reading files left world-readable in a shared directory.