CVE-2026-15955
Received Received - Intake

Arbitrary File Write in IBM Db2

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15955

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm db2 From 11.5.0 (inc) to 11.5.9 (inc)
ibm db2 From 12.1.0 (inc) to 12.1.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are vulnerable to a path traversal issue where a remote attacker can write arbitrary files to the client system due to improper file path validation. This flaw affects Linux and Unix clients but not Windows.

Detection Guidance

To detect this vulnerability, check if your IBM Db2 client versions fall within the affected range (11.5.0 to 11.5.9 or 12.1.0 to 12.1.5) on Linux or Unix systems. Verify if the IBM Data Server driver for JDBC and SQLJ is installed and used for Db2 connections.

Impact Analysis

An attacker could exploit this to overwrite sensitive files on the client machine, potentially leading to data corruption, unauthorized access, or system compromise. The high CVSS score indicates significant integrity impact.

Mitigation Strategies

Apply the security updates provided by IBM for your Db2 client versions via Fix Central. Specifically, update to versions 11.5.9, 12.1.4, or 12.1.5. Since no workarounds are available, patching is the only mitigation method.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart