IBM Maximo Application Suite Information Disclosure
Summary
| CVE | CVE-2026-105052 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-12 21:17:08 UTC |
| Updated | 2026-10-13 16:17:14 UTC |
| Description | IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-22 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Maximo Application Suite | affected 8.10 | Not specified |
| CNA | IBM | Maximo Application Suite | affected 8.11 | Not specified |
| CNA | IBM | Maximo Application Suite | affected 9.0 | Not specified |
| CNA | IBM | Maximo Application Suite | affected 9.1 | Not specified |
| CNA | IBM | Maximo Application Suite | affected 9.2 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7290791 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: A fix has been released for all supported MAS versions and will also be included in the next monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update. Remediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36
Workarounds
CNA: How To Apply the Fix * Open the OpenShift console and navigate to Administration > CustomResourceDefinitions. * Search for coreidp. * Show coreidp instances. * Select the instance associated with your MAS installation; * Edit Coreidp CR for your instance with the following under spec.settings field: * Under the spec.settings field, add the following configuration, replacing <version> with the value specified in the table above for your MAS release: spec: settings: imageTags: coreidplogin: <version> * Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically. * Wait for the new deployment to become ready, then follow the validation steps below. IMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.