CVE-2025-36084

IBM Concert does not properly enforce storage limits. A remote authenticated attacker could cause a denial of service as a result.

IBM Concert is vulnerable to server-side request forgery (SSRF). An authenticated attacker may send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Concert recursively copies build context directories into container images. A local attacker could obtain sensitive information as a result.

IBM Concert versions 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

IBM Concert versions 1.0.0 through 2.1.0 is vulnerable to malicious file upload due to lack of content validation for files uploaded to the web interface. An attacker could exploit this to upload harmful files.

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, potentially allowing viewing, adding, modifying, or deleting information in the back-end database.

IBM Concert versions 1.0.0 through 2.3.1 may allow a remote attacker to perform unauthorized actions using man-in-the-middle techniques due to improper certificate validation.

IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.