CVE-2025-36357
HighCVSS 8.0Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
IBM Planning Analytics Local versions 2.1.0 through 2.1.14 allow a remote authenticated user to traverse directories on the system. An attacker can send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files.
Risk Assessment
An authenticated attacker can access sensitive files, modify them, or write new ones, potentially compromising system confidentiality, integrity, and availability.
Recommendation
Update IBM Planning Analytics Local to a version newer than 2.1.14 if a patch is available, or apply other mitigations recommended by the vendor.
Other vulnerabilities in IBM Planning Analytics Local
See all- CVE-2026-10545High
IBM Planning Analytics Local versions 2.1.0 through 2.1.21 are vulnerable to an open redirect. An attacker can redirect users to arbitrary external websites via a crafted URL. If used in SSO flows, this could expose session tokens and allow session hijacking.
- CVE-2025-36299Medium
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code, which could be used in further attacks against the system.
Original NVD description (English source)
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS