Advisory · CVE-2026-17466
IBM Optim path traversal can expose sensitive information
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal, rated critical at CVSS 9.1.
- Vendor
- IBM
- Product
- Optim
- Identifier / CWE
- CVE-2026-17466
CWE-22 - Action timing
- Immediate
Explain it like I’m five
IBM Optim manages data, and it is supposed to keep file access inside its own folders. A path traversal flaw lets a logged-in attacker climb out of those folders and read sensitive files.
- 01Authenticated access
A remote authenticated attacker reaches Optim.
- 02Traversal crafted
A path is supplied that escapes the intended directory.
- 03Sensitive data read
Files outside the allowed path are returned.
What happened
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. The record rates it critical at CVSS 9.1 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
IBM’s bulletin lists the affected versions and the fix. Optim holds test data management workloads, so the files in reach may include production-like data.
What to do
- Inventory Optim deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review access logs for traversal patterns.
- Determine which files were reachable from the Optim service.
- Verify the deployed version after updating.
Management note
Path traversal on a data management product is a data exposure question. Find out what was readable before moving on.