IBM i EUVD-2026-77762

Requires a valid authenticated session on Navigator for i (PR:L - confirmed by CVSS vector). The decisive limiting condition stated explicitly in the vendor description is that the attacker's IBM i user profile must already possess native OS-level write authority to the target directory; Navigator's path restriction is bypassed, but IBM i object authority is not. Navigator for i must be deployed and network-accessible (it is an optional management component, not mandatory). No special network position beyond HTTP/HTTPS connectivity to the Navigator for i service is required. Non-default configuration of Navigator's file-upload paths is what creates the exploitable gap - a default installation with no Navigator upload configuration would have no restriction to bypass.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the limited blast radius: network-accessible (AV:N), low complexity (AC:L), requires authentication (PR:L), no user interaction (UI:N), no scope change (S:U), no confidentiality or availability impact (C:N/A:N), and only low integrity impact (I:L). The SSVC assessment corroborates this - exploitation status is none, the attack is not automatable (non-default, user-driven upload interaction needed), and technical impact is partial. The vendor description explicitly states exploitation is capped by the user's existing profile permissions, meaning an attacker cannot write to any location they could not already reach via native IBM i access controls; Navigator's restriction is the only thing bypassed. No KEV listing and no POC are present, and no EPSS score was provided in the intelligence, so quantified exploitation probability is unavailable. In practice this is a low-urgency integrity finding: meaningful exploitation requires valid credentials, an accessible Navigator for i deployment, and a user profile with at least partial write authority to a sensitive directory - conditions that collectively make automated or opportunistic exploitation implausible.

An authenticated IBM i user with a valid Navigator for i browser session submits a file-upload request with a manipulated destination path parameter - for example, a relative traversal sequence - that Navigator's input validation does not reject. The file lands in a directory outside the scope Navigator's configuration intended to permit, but within the write authority granted to the user's IBM i profile. This could be used to stage a script or configuration file in a location where it may be executed or loaded by a more privileged process, depending on the target directory's role.