CVE-2026-18515CWE-22path-traversal

CVE-2026-18515

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-14T23:17Z
References (1)
https://www.ibm.com/support/pages/node/7286974 · [email protected]
EPSS history
Timeline
  • 16 SEP 04:25Z
    EPSS moved — → 0%
    epss
  • 14 SEP 18:26Z
    IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
    cvelistv5