CVE-2025-14753: IBM Cloud Pak for Data is vulnerable to path traversal
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Other sources
IBM Cloud Pak for Data could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.2.2
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The provided information identifies IBM Cloud Pak for Data version 5.1.2 as affected. No other versions or deployment configurations are specified.
Does exploitation require authentication or user interaction?
No. The severity vector indicates network-based exploitation with no privileges required and no user interaction required.