{"id":"CVE-2026-17466","kind":"vulnerability","aliases":["CVE-2026-17466"],"related":[],"title":"IBM Optim Test Data Management: path traversal lets signed-in users read sensitive files","description":"IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.","summary":"IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Optim Test Data Management","fixed":["2.0.0"],"affected":"1.0.0, 1.1.0, 1.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-optim","self-hosted","test-data-management","vendor"],"not_affected_if":["optim-2.0.0","other-versions"],"how_to_check":"Check your installed IBM Optim Test Data Management version; 1.0.0, 1.1.0 and 1.2.0 are affected, 2.0.0 is fixed. IBM's bulletin lists no detection command. Also check any other Optim components you run (the bulletin names only Test Data Management).","fix":"Move to IBM Optim Test Data Management 2.0.0 (Passport Advantage); it validates requested file paths stay within the permitted directory.","status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:37+00:00","updated_at":"2026-11-08T18:23:07+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T18:22:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Optim: path traversal lets signed-in users read sensitive files","impact":"medium","summary":"IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-optim"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive files from the server","analyst_note":"Check the IBM security bulletin for affected versions, fixed releases and the exact data exposed; NVD lists CVSS 9.1 with no fix details.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running IBM Optim versions 1.0.0, 1.1.0 or 1.2.0 that allow remote authenticated access. The sources do not say which deployment settings expose it. Teams not running these versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000668,"input_tokens":4526,"output_tokens":431,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for affected versions, fixed releases and the exact data exposed; NVD lists CVSS 9.1 with no fix details.","search":"'-17466':18A,21A '-2026':17A,20A '1.0.0':41B,66C '1.1.0':42B,67C '1.2.0':44B,69C 'account':56B 'allow':71C 'attack':52B,75C 'authent':74C 'contain':45B 'could':70C 'cve':16A,19A 'data':4A,25A,35B 'due':80C 'file':15A 'flaw':49B 'host':32B 'ibm':1A,22A,28B,38B,64C 'ibm-optim':27B 'inform':63B,79C 'let':8A 'manag':5A,36B 'management':26A 'obtain':61B,77C 'optim':2A,23A,29B,39B,65C 'path':6A,47B,82C 'read':13A 'remot':51B,73C 'self':31B 'self-host':30B 'sensit':14A,62B,78C 'sign':10A 'signed-in':9A 'test':3A,24A,34B 'test-data-manag':33B 'travers':7A,48B,83C 'use':58B 'user':12A 'valid':55B 'vendor':37B 'version':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Optim Test Data Management 1.0.0, 1.1.0 or 1.2.0 where a user can sign in. A remote authenticated user can use a file-path request to read files outside the permitted directory. Teams on 2.0.0 or not using Optim can skip it. IBM lists no workarounds.","tier":"B","verified":{"fix":{"at":"2026-11-08T18:23:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","run_id":2210},"products":{"at":"2026-11-08T18:23:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","run_id":2210},"workarounds":{"at":"2026-11-08T18:23:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","run_id":2210},"how_to_check":{"at":"2026-11-08T18:23:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","run_id":2210},"who_affected":{"at":"2026-11-08T18:23:07Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","run_id":2210}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmoptimtestdatamanagement","optimtestdatamanagement"],"ptokens":["data","ibm","management","optim","test"],"labels":["critical","ibmoptim","selfhosted","testdatamanagement","vendor"],"campaign_type":null,"search_a":"'-17466':18A,21A '-2026':17A,20A 'cve':16A,19A 'data':4A,25A 'file':15A 'ibm':1A,22A 'let':8A 'manag':5A 'management':26A 'optim':2A,23A 'path':6A 'read':13A 'sensit':14A 'sign':10A 'signed-in':9A 'test':3A,24A 'travers':7A 'user':12A","search_b":"'1.0.0':41B '1.1.0':42B '1.2.0':44B 'account':56B 'attack':52B 'contain':45B 'data':35B 'flaw':49B 'host':32B 'ibm':28B,38B 'ibm-optim':27B 'inform':63B 'manag':36B 'obtain':61B 'optim':29B,39B 'path':47B 'remot':51B 'self':31B 'self-host':30B 'sensit':62B 'test':34B 'test-data-manag':33B 'travers':48B 'use':58B 'valid':55B 'vendor':37B 'version':40B","search_c":"'1.0.0':66C '1.1.0':67C '1.2.0':69C 'allow':71C 'attack':75C 'authent':74C 'could':70C 'due':80C 'ibm':64C 'inform':79C 'obtain':77C 'optim':65C 'path':82C 'remot':73C 'sensit':78C 'travers':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17466","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17466:2210","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","severity":null,"published_at":"2026-11-08T18:23:07+00:00","modified_at":"2026-11-08T18:23:07+00:00","first_seen_at":"2026-11-08T18:23:07+00:00","fetched_at":"2026-11-08T18:23:07+00:00","note":"Read IBM bulletin (published 2026-09-28): affected 1.0.0/1.1.0/1.2.0, fixed 2.0.0, no workarounds. IBM rates the bulletin medium but CVSS 9.1 (IBM vector, PR:L). No exploitation or PoC found. Same bulletin covers two other vulns (rate limiting, weak default password).","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22"]}],"documents":[{"id":102924,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22","title":"IBM Security Bulletin: Optim Test Data Management 1.0.0-1.2.0 path traversal (CVE-2026-17466)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}