Advisory · CVE-2026-84842
IBM Guardium Datasource REST allows path traversal and file deletion
An authenticated remote attacker can exploit path traversal in the IBM Guardium Data Protection 12.2 Datasource REST component to delete arbitrary files and degrade system integrity.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-84842
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Guardium's Datasource API lets a logged-in user point at files by name but does not check whether the name sneaks outside its own folder. An attacker can hand it a path like '../../../' and have it delete files it was never supposed to touch.
- 01Authenticated API access
An attacker with valid credentials reaches the Datasource REST endpoints.
- 02Crafted file path
The attacker submits a datasource path containing directory traversal sequences.
- 03Missing validation
The component trusts the path and resolves it outside the intended directory (CWE-22).
- 04File deletion
The resolved path is deleted, allowing denial of service and integrity damage.
What happened
IBM disclosed CVE-2026-84842 in Guardium Data Protection 12.2. The Datasource REST component is vulnerable to path traversal combined with arbitrary file deletion: an authenticated remote attacker can supply a crafted path, escape the intended directory, and delete files. It carries a CVSS 3.1 score of 8.1 (high).
What to do
- Inventory Guardium Data Protection 12.2 instances and identify which REST users hold datasource permissions.
- Apply the remediation or fix from the IBM security bulletin.
- Restrict Datasource REST access to trusted users while remediation is underway.
- Review API logs for datasource requests containing traversal sequences such as dot-dot-slash patterns.
- Check for unexpected deletions of configuration, policy, or data files and restore from backups where needed.
Management note
File deletion on a data protection appliance is not just downtime; it can silently remove the policies and audit trails the system exists to preserve. Confirm backup integrity and restore points as part of the response, not after.