{"id":"CVE-2026-84275","published":"2026-10-08T20:17:38.077","lastModified":"2026-10-12T23:17:42.743","description":"IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":["ibm"],"products":["guardium data protection"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288035","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Guardium Data Protection 12.2 contains a path traversal vulnerability in its GIM file-upload functionality that allows unauthenticated attackers to write arbitrary files to the Collector system. This flaw enables attackers to potentially compromise the data protection platform and gain unauthorized access to sensitive data.","exploitability":"Exploitation is relatively straightforward as it requires only an unauthenticated upload request to a specific endpoint, with no additional authentication or complex preconditions needed.","blast_radius":"If exploited, this vulnerability could allow attackers to write malicious files to the Collector system, potentially leading to arbitrary code execution, data exfiltration, or complete compromise of the Guardium Data Protection platform.","remediation":"Upgrade to IBM Guardium Data Protection 12.3 or later to remediate this path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","file-upload","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:24:50.660Z"}}