Path Traversal Vulnerability in IBM Cloud Pak for Data

IBM Cloud Pak for Data version 5.1.2 is susceptible to a path traversal vulnerability identified as CVE-2025-14753. This vulnerability stems from improper input validation in the web application component, allowing a remote, unauthenticated attacker to bypass directory restrictions. By injecting directory traversal sequences (such as /../) into a crafted URL request, an attacker can navigate outside the intended web root directory to read arbitrary files stored on the underlying system. This flaw poses a significant risk to the confidentiality of the server's filesystem, potentially exposing configuration files, sensitive credentials, or internal application data. Defenders should prioritize patching affected instances to the latest secure version provided by IBM.

Impact

Successful exploitation of CVE-2025-14753 allows unauthorized read access to files on the host system. This may facilitate the exfiltration of sensitive information, such as environment variables, application source code, or configuration credentials, which could lead to further compromise of the platform or connected data environments.

Recommendation

• Apply the security patches provided by IBM for Cloud Pak for Data 5.1.2 immediately to remediate CVE-2025-14753.
• Review web server access logs for anomalous URL patterns containing repetitive directory traversal sequences (e.g., "../") directed at non-public file paths.
• Implement strict input validation and access control policies at the Web Application Firewall (WAF) layer to block requests containing path traversal sequences directed at the application API.