IBM OPTIM TEST DATA MANAGEMENT · CVE-2026-17466 · Vendor
FIX → 2.0.0 ✓ verified
IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM Optim Test Data Management 1.0.0, 1.1.0 or 1.2.0 where a user can sign in. A remote authenticated user can use a file-path request to read files outside the permitted directory. Teams on 2.0.0 or not using Optim can skip it. IBM lists no workarounds.
Not affected if optim-2.0.0, other-versions
Who cares ibm-optim, self-hosted, test-data-management
1.0.0, 1.1.0 and 1.2.0 are affected, 2.0.0 is fixedIBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.0.0
Move to IBM Optim Test Data Management 2.0.0 (Passport Advantage); it validates requested file paths stay within the permitted directory.