CVE-2026-18554
Received Received - Intake

IBM Db2 Mirror for i Path Traversal Vulnerability

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: IBM Corporation

Description
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-15
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-18554
EUVD
EUVD-2026-58770

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ibm db2_mirror_for_i From 7.4 (inc)
ibm db2_mirror_for_i From 7.5 (inc)
ibm db2_mirror_for_i From 7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Db2 Mirror for i allows a remote authenticated attacker to access sensitive information. It occurs because the software does not properly restrict file paths, enabling unauthorized access to restricted directories.

Impact Analysis

An attacker could exploit this to steal confidential data stored in the affected system. This may lead to data breaches, financial loss, or reputational damage depending on the sensitivity of the exposed information.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing personal or health data. Organizations may face legal penalties, fines, or mandatory audits if such breaches occur due to inadequate security controls.

Mitigation Strategies

Apply the latest IBM Db2 Mirror for i patches or updates to address the improper pathname restriction. Ensure network segmentation and restrict remote authenticated access to sensitive directories. Monitor for unusual access patterns or data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart