---
id: "CVE-2026-17466"
page: "https://infrastack.ai/live/CVE-2026-17466"
kind: "vulnerability"
aliases: ["CVE-2026-17466"]
title: "IBM Optim Test Data Management: path traversal lets signed-in users read sensitive files"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM Optim Test Data Management", "fixed": ["2.0.0"], "affected": "1.0.0, 1.1.0, 1.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-optim", "self-hosted", "test-data-management", "vendor"]
not_affected_if: ["optim-2.0.0", "other-versions"]
published_at: "2026-11-08T18:17:03+00:00"
first_seen_at: "2026-11-08T18:22:22+00:00"
updated_at: "2026-11-08T18:23:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17466", "first_seen_at": "2026-11-08T18:22:22+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22", "first_seen_at": "2026-11-08T18:23:07+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22"]}]
exploit_sources: []
---

# IBM Optim Test Data Management: path traversal lets signed-in users read sensitive files

Link for people: https://infrastack.ai/live/CVE-2026-17466 (this .md is for agents)

IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 contain a path traversal flaw. A remote attacker with a valid account can use it to obtain sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Optim Test Data Management affected 1.0.0, 1.1.0, 1.2.0 fixed 2.0.0

## How to check

Check your installed IBM Optim Test Data Management version; 1.0.0, 1.1.0 and 1.2.0 are affected, 2.0.0 is fixed. IBM's bulletin lists no detection command. Also check any other Optim components you run (the bulletin names only Test Data Management).

## Fix

Move to IBM Optim Test Data Management 2.0.0 (Passport Advantage); it validates requested file paths stay within the permitted directory.

## Timeline

- 2026-11-08T18:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17466
- 2026-11-08T18:23:07+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22 — Read IBM bulletin (published 2026-09-28): affected 1.0.0/1.1.0/1.2.0, fixed 2.0.0, no workarounds. IBM rates the bulletin medium but CVSS 9.1 (IBM vector, PR:L). No exploitation or PoC found. Same bulletin covers two other vulns (rate limiting, weak default password).

## Documents

- [advisory] IBM Security Bulletin: Optim Test Data Management 1.0.0-1.2.0 path traversal (CVE-2026-17466) https://www.ibm.com/support/pages/security-bulletin-ibm-optim-test-data-management-100-110-and-120-impacted-path-traversal-rate-limiting-and-weak-password-policy-vulnerabilities-cwe-22

## From the sources

IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_