{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-105052", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-10-02T23:51:23.455Z", "datePublished": "2026-10-12T21:01:02.786Z", "dateUpdated": "2026-10-12T21:05:04.599Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-10-12T21:05:04.599Z" }, "title": "IBM Maximo Application Suite Information Disclosure", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE" } ] } ], "affected": [ { "vendor": "IBM", "product": "Maximo Application Suite", "versions": [ { "status": "affected", "version": "8.10" }, { "status": "affected", "version": "8.11" }, { "status": "affected", "version": "9.0" }, { "status": "affected", "version": "9.1" }, { "status": "affected", "version": "9.2" } ], "cpes": [ "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*" ] } ], "descriptions": [ { "lang": "en", "value": "IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.

" } ] } ], "references": [ { "url": "https://www.ibm.com/support/pages/node/7290791", "tags": [ "vendor-advisory", "patch" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } } ], "workarounds": [ { "lang": "en", "value": "How To Apply the Fix\n\n * Open the OpenShift console and navigate to Administration > CustomResourceDefinitions. \n * Search for coreidp.\n * Show coreidp instances.\n * Select the instance associated with your MAS installation;\n * Edit Coreidp CR for your instance with the following under spec.settings field:\n * Under the spec.settings field, add the following configuration, replacing with the value specified in the table above for your MAS release:\n\n\nspec:\n settings:\n imageTags:\n coreidplogin: \n\n\n * Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\n * Wait for the new deployment to become ready, then follow the validation steps below. \n\nIMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

How To Apply the Fix

  1. Open the OpenShift console and navigate to Administration > CustomResourceDefinitions. 
  2. Search for coreidp.
  3. Show coreidp instances.
  4. Select the instance associated with your MAS installation;
  5. Edit Coreidp CR for your instance with the following under spec.settings field:
  6. Under the spec.settings field, add the following configuration, replacing <version> with the value specified in the table above for your MAS release:
    spec:\n  settings:\n    imageTags:\n      coreidplogin: <version>
  7. Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.
  8. Wait for the new deployment to become ready, then follow the validation steps below. 

    IMPORTANT    : Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.

" } ] } ], "solutions": [ { "lang": "en", "value": "A fix has been released for all supported MAS versions and will also be included in the next monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update.\n\nRemediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

A fix has been released for all supported MAS versions and will also be included in the next monthly update. We strongly recommend applying this fix immediately rather than waiting for the monthly update.

Remediated Product(s)Mas Verision(s)CoreIdp Version(s)
IBM Maximo Application Suite8.10.373.2.201
IBM Maximo Application Suite8.11.344.0.179
IBM Maximo Application Suite9.0.325.1.148
IBM Maximo Application Suite9.1.266.3.60
IBM Maximo Application Suite9.2.78.1.36
" } ] } ] } } }