CVE-2025-14753

HighCVSS 7.5

Published: 18/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

39th percentile - higher than 39% of all known CVEs

Summary

IBM Cloud Pak for Data 5.1.2 allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Risk Assessment

A remote attacker could read arbitrary files on the system, potentially leading to leakage of sensitive data and configuration information.

Recommendation

Update IBM Cloud Pak for Data to the patched version and verify that the application properly normalizes paths in URL requests.

Other vulnerabilities in IBM Cloud Pak for Data

CVE-2025-14754High
IBM Cloud Pak for Data 5.1.2 contains improper validation of user-supplied input. An authenticated user could execute arbitrary commands with elevated privileges on the system.

Original NVD description (English source)

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS