CVE-2026-79715: IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
Other sources
IBM WebSphere Application Server Liberty could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.10
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low-level privileges on the affected Liberty system. The attacker must be able to provide a specially crafted application archive.
What is the impact of a successful exploit?
A successful attacker can write files outside the directory intended for application archive extraction or deployment. The supplied information identifies integrity impact, with no confidentiality or availability impact listed.
Which Liberty versions are affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are identified as affected.