BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-19

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-13

Last Modified

2025-11-19

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36236

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	vios	3.1.0
ibm	vios	4.1.0
ibm	aix	7.2
ibm	aix	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the IBM AIX 7.2 and 7.3, and IBM VIOS 3.1 and 4.1 NIM server service (nimesis). It allows a remote attacker to traverse directories on the system and send specially crafted URL requests to write arbitrary files on the system.

Impact Analysis

The vulnerability can allow a remote attacker to write arbitrary files on the affected system, potentially leading to unauthorized modification of system files or data, which can compromise system integrity and availability.

Hi! I’m here to help you understand CVE-2025-36236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70