EUVD-2026-57364
GHSA-fhh6-8v5p-q8hv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible path traversal requiring low-privilege credentials; no integrity or availability impact, only confidentiality disclosure.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
AnalysisAI
Path traversal in IBM i 7.3 through 7.6 exposes sensitive files to remote authenticated attackers by failing to enforce restricted directory boundaries. The vulnerability (CWE-22) allows a low-privileged authenticated user to escape intended directory scope and read arbitrary file system paths, resulting in high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
IBM i (formerly AS/400 / iSeries) is IBM's proprietary integrated operating system and application platform. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal), a root cause where user-supplied path input is not properly sanitized or canonicalized before being used to access file system resources. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers IBM i versions 7.3, 7.4, 7.5, and 7.6. An attacker who has already authenticated to the system can craft a path containing traversal sequences (e.g., '../') to escape the intended restricted directory and access files outside the sanctioned scope. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms this is network-exploitable with low complexity, requiring only low-privilege credentials, with no user interaction needed.
RemediationAI
The primary remediation is to apply the vendor-released patch via IBM's official advisory at https://www.ibm.com/support/pages/node/7283292, which provides PTF details specific to IBM i 7.3, 7.4, 7.5, and 7.6. Exact fixed PTF versions should be obtained directly from that advisory, as they were not enumerated in the available input data. As a compensating control prior to patching, administrators should audit and restrict low-privilege account access to any services or interfaces through which path traversal could be triggered, and review file system authority settings to ensure sensitive directories are not readable by general user profiles. Restricting network access to IBM i management interfaces (e.g., IBM Navigator for i, DDM, FTP) to trusted hosts reduces exposure surface, though it does not eliminate the underlying flaw. Each workaround carries the trade-off of reduced functionality or administrative overhead.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today