CVE-2026-105052: IBM Maximo Application Suite Information Disclosure
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Other sources
Maximo Application Suite could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Maximo Application Suite CoreIdp for MAS 8.10to a version that resolves this vulnerability.Fixed in 373.2.201 - Upgrade
Upgrade
IBM Maximo Application Suite CoreIdp for MAS 8.11to a version that resolves this vulnerability.Fixed in 344.0.179 - Upgrade
Upgrade
IBM Maximo Application Suite CoreIdp for MAS 9.0to a version that resolves this vulnerability.Fixed in 325.1.148 - Upgrade
Upgrade
IBM Maximo Application Suite CoreIdp for MAS 9.1to a version that resolves this vulnerability.Fixed in 266.3.60 - Upgrade
Upgrade
IBM Maximo Application Suite CoreIdp for MAS 9.2to a version that resolves this vulnerability.Fixed in 78.1.36
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2 are identified as affected.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by sending a specially crafted URL containing directory-traversal sequences such as /../. No privileges or user interaction are required according to the supplied severity vector.
What could an attacker access?
A successful exploit may allow the attacker to view arbitrary files on the system. The provided information describes an information-disclosure impact and does not indicate file modification or service disruption.