CVE-2026-113692: Path Traversal in BMC ITSM
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as an administrator. The affected functionality is the SmartIT file-management feature, so exposure is limited to deployments where that feature is available to administrative users.
What is the impact of successful exploitation?
A successful attacker can read files outside the directory intended by the file-management feature. The provided information describes confidentiality impact only; it does not indicate modification or deletion of files.
Which versions are identified as affected?
The affected BMC IT Service Management Suite versions are 25.3.01, 25.4.01, and 26.1.01.