EUVD-2026-104466
GHSA-h65q-98c2-q928
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MQ Web Console as admin
-
ExploitSubmit request with traversal path
-
ExecutionBypass path validation
-
ImpactWrite file outside intended directory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session as an administrator of the IBM MQ Web Console (CVSS PR:H), and the attacker must be able to supply a path parameter that the console processes for a file-write operation. The limiting factors are significant: the administrator privilege requirement means only already-trusted or already-compromised privileged accounts can trigger the flaw, UI:N means no victim interaction is needed, and impact is confined to integrity (writing files outside the intended directory) with no confidentiality or availability effect. Applicable specifically to IBM MQ deployments using the MQ Operator or MQ Advanced Container Images where the Web Console is exposed and used for administration. |
| Impact | This is a low-severity, low-priority issue despite being network-reachable. The CVSS 3.1 base score of 2.7 is driven almost entirely by the high privilege requirement (PR:H) and the limited impact (I:L only; no confidentiality or availability impact, no scope change). The attacker must already be an authenticated administrator of the IBM MQ Web Console, which means the actor already holds substantial legitimate control over the product - the path-traversal write primarily lets a privileged user step outside the intended directory rather than escalate from an unprivileged position. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The AV:N designation is consistent with the web console being a network-facing management interface, and it aligns with the description. The dominant real-world risk signal here is the PR:H gate: exploitation presupposes a trusted administrator, so this is best treated as a defense-in-depth hardening fix rather than an urgent externally-driven threat. No signals conflict; the limiting factor is simply that the vulnerability is only reachable by an already-privileged user. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has already compromised administrator credentials) of the IBM MQ Web Console submits a request containing a crafted path with traversal sequences, causing a file to be written outside the intended directory on the host or container filesystem. No public proof-of-concept exploit was identified in the provided intelligence. Because exploitation requires existing administrator access over the network (AV:N/PR:H), the practical scenario is a malicious or compromised privileged operator rather than an anonymous remote attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Path traversal in IBM MQ Web Console allows an authenticated administrator to write files outside the intended directory in deployments using IBM MQ Operator or IBM MQ Advanced Container Images. The issue is low severity (CVSS 2.7) with integrity-only impact and a high privilege prerequisite, and no public exploit identified at time of analysis; a vendor patch is available per IBM advisory.
RemediationAI
Patch available per vendor advisory: consult IBM support node 7292667 to identify and deploy the fixed IBM MQ Operator and IBM MQ Advanced Container Images releases, then redeploy affected containers. Because the provided data does not include an exact fix version, do not assume a version number beyond what IBM publishes in that advisory. Until patched, restrict IBM MQ Web Console access to trusted administrative networks, enforce strong authentication and least privilege for console administrators, and monitor for unexpected file writes or path traversal attempts; these measures reduce exposure but do not correct the underlying path validation flaw. Given the PR:H prerequisite, also prioritize detection and rotation of potentially compromised administrator credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-22 path traversal, arising from improper validation of path input processed by the IBM MQ Web Console for a file-write operation. An attacker who already holds administrator-level access to the console can supply a crafted path that escapes the intended directory and causes files to be written elsewhere on the underlying filesystem. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N indicates network reachability, low attack complexity, a high privilege requirement, no user interaction, unchanged scope, and impact limited to integrity; there is no confidentiality or availability effect. The provided CPE entries identify IBM MQ Operator and IBM MQ Advanced Container Images as the affected products, with wildcard versions meaning the data does not constrain affected releases further. Exploitation requires an authenticated Web Console administrator able to control the path parameter used in the file-write flow, so the practical risk is concentrated in environments where administrative console access is exposed or privileged accounts are compromised.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Network-facing web console (AV:N) but exploitation needs administrator authentication (PR:H); only a limited out-of-directory file write, so I:L and C:N/A:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Exploit-DB