EUVD-2026-100487
GHSA-7f6g-4h8g-5rpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain application-deployment privileges
-
DeliveryCraft archive with traversal paths
-
ExploitDeploy archive to Liberty
-
ExecutionServer writes files outside target dir
-
ImpactOverwrite config/binaries to tamper system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local, authenticated access with the ability to deploy a specially crafted application archive to WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9); the malicious archive contains directory-traversal path entries that cause files to be written outside the intended application directory during deployment/expansion. This is NOT remotely exploitable without credentials - the limiting factors are the local attack vector (AV:L) and the need for application-deployment privileges (PR:L), meaning the attacker must already be a trusted or compromised deployer. There is no confidentiality or availability impact; only file-write/integrity (I:H) is affected. Exploitation does not require user interaction (UI:N). |
| Impact | This is a moderate-severity, low-urgency issue rather than a top priority. The IBM-provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a local, low-privilege attacker who can write files outside the intended directory via a crafted application archive - impacting integrity only (I:H), with no confidentiality or availability loss. The key limiting factor is AV:L combined with PR:L: the attacker must already be able to deploy an application archive to the Liberty server (an authenticated/local capability), which is typically restricted to developers or deployment operators. No EPSS score, KEV listing, POC, or SSVC data was provided in the input; absence of these is consistent with a newly disclosed vendor-reported flaw but means exploitation likelihood cannot be quantified. The CVSS vector and the textual description are internally consistent - both point to local/deployment-time write access, not remote unauthenticated attack - so there is no conflicting signal to flag. Bottom line: a legitimate hardening priority for environments where untrusted parties can deploy applications, but not an emergency given the local vector and authentication requirement. |
| Exploit ScenarioDerived | An attacker with the ability to deploy applications to a WebSphere Liberty server (e.g., a developer or a compromised CI/CD deployment account) builds a malicious application archive containing path-traversal sequences in its entries. When the server expands the archive, files are written outside the intended application directory, allowing the attacker to overwrite configuration or binaries and potentially escalate. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Directory traversal in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a local, authenticated attacker who can deploy application archives write files outside the intended application directory by embedding crafted path entries in an archive. The attack is constrained rather than remote: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (5.5), meaning the attacker must already hold local access and application-deployment privileges, and the only impact is integrity (file write) with no confidentiality or availability loss. This is a moderate-severity, low-urgency issue rather than a top priority; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
RemediationAI
No vendor-released patch identified at time of analysis in the supplied intelligence; the fix level, APAR and interim-fix details should be taken directly from IBM Support node 7291394 (https://www.ibm.com/support/pages/node/7291394), and deployments should be upgraded to the first fixed Liberty release IBM publishes for this APAR once confirmed. Until then, apply compensating controls: restrict who can deploy applications or push archives to Liberty (remove or tightly scope the deployment role so only fully trusted administrators under PR:L-or-higher-equivalent control can submit archives), which directly removes the assessed prerequisite but slows legitimate deployment workflows; enforce a privileged, non-interactive review gate that inspects incoming archives for entry names containing '..', absolute paths, or drive-letter prefixes before deployment, accepting that this is a procedural control that can be bypassed by encoding tricks and adds release latency; run the Liberty JVM under a dedicated low-privilege OS account with the server directory tree (writable configuration, drop-ins, and shared libraries) mounted read-only or owned by a different user than the runtime account, so traversal writes land in a sandboxed area - the trade-off is potential breakage of features that legitimately write to those locations; and monitor file-system integrity (e.g., FIM/auditd) on the Liberty installation and configuration directories for out-of-band creations, which detects successful exploitation but does not prevent it. There is no confidentiality or availability impact assessed, so remediation priority should be driven by whether untrusted parties hold deployment rights in your environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-22 path traversal that manifests during application archive (WAR/EAR-style) deployment in the Liberty runtime. Liberty expands uploaded archives onto the server filesystem, and the code that resolves archive entry names into target paths does not adequately neutralize traversal sequences (such as ../) or absolute path components, allowing extracted content to land outside the designated application/temp directory. This is the classic 'Zip Slip' class, rooted in insufficient canonicalization and containment checking of the destination path before a write. Because the write is driven by the deployment identity rather than a remote request, the attack surface is the deployment pipeline, but the resulting primitive is arbitrary file write within whatever the deploying OS user can reach - which can, depending on filesystem permissions and writable config/classpath locations, enable tampering with server configuration or loading of attacker-supplied code on subsequent restarts. Per the independent assessment, there is no confidentiality or availability impact (C:N/A:N) and the integrity impact is rated High; the CVSS vector confirms a local (AV:L), low-privilege (PR:L), no-interaction (UI:N) exploitation path, so this should not be characterized as unauthenticated or remote.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Requires local ability to deploy an application archive, so AV:L and PR:L; crafted archive is reliable (AC:L); only file-write integrity impact, hence C:N/I:H/A:N.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB