CVE-2026-18554

HighCVSS 7.5

Published: 14/08/2026(UTC)Updated: 21/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.85%

56th percentile - higher than 56% of all known CVEs

Summary

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Risk Assessment

An authenticated attacker could read files outside the allowed directory, potentially leading to data leakage.

Recommendation

Apply patches from IBM for Db2 Mirror for i versions 7.4, 7.5, and 7.6.

Original NVD description (English source)

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.