IBM STORAGE SCALE · CVE-2026-14437 · Infrastructure
NO FIX YET
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 fails to block directory traversal in URL requests. A remote attacker can send a crafted URL with "../" sequences to read arbitrary files on the system.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Storage Scale 5.2.3.0 through 5.2.3.9 or 6.0.1.0 that expose its HTTP-facing services to untrusted networks. Systems on the affected versions that are reachable only from a tightly controlled internal network carry less exposure. The sources do not name the specific web component involved.
Not affected if unaffected-version
Who cares ibm-storage-scale, self-hosted
mmdiag --version, and compare it to the affected ranges 5.2.3.0 through 5.2.3.9 and 6.0.1.0.No fix yet, per the sources.
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.