← Back

CVE-2025-36357

nvd nist
Published: Nov 17, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.0
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.1 / Impact: 5.9
Source: psirt@us.ibm.com (Secondary)

Description

IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system.

Affected (2)

Ibm
2 products
Planning Analytics Local
Planning Analytics Workspace
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Planning Analytics Local
From 2.1.0 to 2.1.15
Planning Analytics Workspace
From 2.1.0 to 2.1.15

Related CWEs

CWE-36
Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.