{"id":"CVE-2026-82900","published":"2026-10-08T22:17:32.753","lastModified":"2026-10-14T20:31:15.800","description":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":["ibm"],"products":["guardium data protection"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288832","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Guardium Data Protection allows remote attackers to delete arbitrary files due to improper path name limitation, which could lead to data loss or system compromise. This vulnerability arises from insufficient validation of file paths that could be manipulated to access restricted directories.","exploitability":"Exploitation requires a remote attacker with network access to the Guardium service, and is moderately difficult due to the need for precise path manipulation to bypass directory restrictions.","blast_radius":"If exploited, this vulnerability could allow attackers to delete critical system files, configuration data, or sensitive database files, potentially leading to complete system outages or data breaches.","remediation":"Upgrade to IBM Guardium Data Protection 12.2.3 or later to address this arbitrary file deletion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-delete","path-traversal","remote-exploit","data-protection"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:19:05.707Z"}}