CVE-2026-6925
published 2026-09-23CVE-2026-6925: IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request…
PriorityP336medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.33%
24.4th percentile
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | concert | 1.0.0 – 3.0.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system.
ghsa_unreviewed·2026-09-23
CVE-2026-6925 [MEDIUM] CWE-22 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system.
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.
VulDB
IBM Concert up to 3.0.0 path traversal
vuldb·2026-09-23·CVSS 5.3
CVE-2026-6925 [MEDIUM] IBM Concert up to 3.0.0 path traversal
A vulnerability was found in IBM Concert up to 3.0.0. It has been rated as problematic. This affects an unknown function. The manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-6925. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-23
Published