CVE-2026-18106

Analyzed Analyzed - Analysis Complete

IBM i Path Traversal Vulnerability Exposes Sensitive Data

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18106

EUVD

EUVD-2026-57350

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to a flaw where a remote authenticated attacker can access sensitive information. This occurs because the system fails to properly validate user-supplied path input.

Detection Guidance

This vulnerability involves improper validation of user-supplied path input in IBM i systems. Detection requires checking for unauthorized access attempts or sensitive information exposure. Review system logs for unusual path traversal patterns or requests to restricted directories. Monitor for unexpected data retrieval by authenticated users. No specific commands are provided in the available context.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data stored on the IBM i system. This may lead to data breaches, information leaks, or further attacks if the exposed data is used maliciously.

Compliance Impact

The vulnerability allows remote authenticated attackers to obtain sensitive information due to improper path validation in IBM i systems. This could lead to unauthorized access to confidential data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy).

Mitigation Strategies

Apply IBM i PTFs or updates to address improper path validation. Ensure only authenticated users have access to sensitive paths. Monitor network traffic for unusual requests targeting IBM i systems.

Hi! I’m here to help you understand CVE-2026-18106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70