Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Storage Scale Container Native and CSI by IBM
CVE-2026-14469 (GCVE-0-2026-14469)
Vulnerability from nvd – Published: 2026-11-08 17:26 – Updated: 2026-11-09 18:54
VLAI
EPSS
VEX
Title
IBM Storage Scale Incorrect Authorization
Summary
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 18:54 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291295 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Storage Scale Container Native and CSI |
Affected:
6.0.1.0
(semver)
Affected: 5.2.3.0 , ≤ 5.2.3.9 (semver) cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T18:54:05.794466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:54:43.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:*"
],
"product": "Storage Scale Container Native and CSI",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "6.0.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.3.9",
"status": "affected",
"version": "5.2.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.\u003c/p\u003e"
}
],
"value": "IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T17:26:41.436Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291295"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eFor IBM Storage Scale Container Native (CSI is bundled with it)\u003c/div\u003e\u003cul\u003e\u003cli\u003e5.2.3.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/5.2.3\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/5.2.3\u003c/a\u003e\u003c/li\u003e\u003cli\u003e6.0.1.x:\u00a0 \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/6.0.1\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/6.0.1\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003cbr/\u003eCSI standalone:\u003c/div\u003e\u003cul\u003e\u003cli\u003e2.14.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/2.14.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/2.14.x\u003c/a\u003e\u003c/li\u003e\u003cli\u003e3.1.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/3.1.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/3.1.x\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "For IBM Storage Scale Container Native (CSI is bundled with it)\n\n * 5.2.3.x: https://www.ibm.com/docs/en/scalecontainernative/5.2.3 \n * 6.0.1.x:\u00a0 https://www.ibm.com/docs/en/scalecontainernative/6.0.1 \n\n\n\nCSI standalone:\n\n * 2.14.x: https://www.ibm.com/docs/en/scalecsi/2.14.x \n * 3.1.x: https://www.ibm.com/docs/en/scalecsi/3.1.x"
}
],
"title": "IBM Storage Scale Incorrect Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14469",
"datePublished": "2026-11-08T17:26:41.436Z",
"dateReserved": "2026-07-02T14:16:20.602Z",
"dateUpdated": "2026-11-09T18:54:43.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14437 (GCVE-0-2026-14437)
Vulnerability from nvd – Published: 2026-11-08 17:24 – Updated: 2026-11-09 17:20
VLAI
EPSS
VEX
Title
IBM Storage Scale Path Traversal
Summary
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:20 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291295 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Storage Scale Container Native and CSI |
Affected:
6.0.1.0
(semver)
Affected: 5.2.3.0 , ≤ 5.2.3.9 (semver) cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:20:27.677679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:20:38.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:*"
],
"product": "Storage Scale Container Native and CSI",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "6.0.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.3.9",
"status": "affected",
"version": "5.2.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e"
}
],
"value": "IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T17:27:45.092Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291295"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eFor IBM Storage Scale Container Native (CSI is bundled with it)\u003c/div\u003e\u003cul\u003e\u003cli\u003e5.2.3.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/5.2.3\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/5.2.3\u003c/a\u003e\u003c/li\u003e\u003cli\u003e6.0.1.x:\u00a0 \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/6.0.1\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/6.0.1\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003cbr/\u003eCSI standalone:\u003c/div\u003e\u003cul\u003e\u003cli\u003e2.14.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/2.14.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/2.14.x\u003c/a\u003e\u003c/li\u003e\u003cli\u003e3.1.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/3.1.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/3.1.x\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "For IBM Storage Scale Container Native (CSI is bundled with it)\n\n * 5.2.3.x: https://www.ibm.com/docs/en/scalecontainernative/5.2.3 \n * 6.0.1.x:\u00a0 https://www.ibm.com/docs/en/scalecontainernative/6.0.1 \n\n\n\nCSI standalone:\n\n * 2.14.x: https://www.ibm.com/docs/en/scalecsi/2.14.x \n * 3.1.x: https://www.ibm.com/docs/en/scalecsi/3.1.x"
}
],
"title": "IBM Storage Scale Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14437",
"datePublished": "2026-11-08T17:24:47.966Z",
"dateReserved": "2026-07-01T21:59:30.877Z",
"dateUpdated": "2026-11-09T17:20:38.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14469 (GCVE-0-2026-14469)
Vulnerability from cvelistv5 – Published: 2026-11-08 17:26 – Updated: 2026-11-09 18:54
VLAI
EPSS
VEX
Title
IBM Storage Scale Incorrect Authorization
Summary
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 18:54 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291295 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Storage Scale Container Native and CSI |
Affected:
6.0.1.0
(semver)
Affected: 5.2.3.0 , ≤ 5.2.3.9 (semver) cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T18:54:05.794466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:54:43.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:*"
],
"product": "Storage Scale Container Native and CSI",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "6.0.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.3.9",
"status": "affected",
"version": "5.2.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.\u003c/p\u003e"
}
],
"value": "IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T17:26:41.436Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291295"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eFor IBM Storage Scale Container Native (CSI is bundled with it)\u003c/div\u003e\u003cul\u003e\u003cli\u003e5.2.3.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/5.2.3\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/5.2.3\u003c/a\u003e\u003c/li\u003e\u003cli\u003e6.0.1.x:\u00a0 \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/6.0.1\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/6.0.1\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003cbr/\u003eCSI standalone:\u003c/div\u003e\u003cul\u003e\u003cli\u003e2.14.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/2.14.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/2.14.x\u003c/a\u003e\u003c/li\u003e\u003cli\u003e3.1.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/3.1.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/3.1.x\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "For IBM Storage Scale Container Native (CSI is bundled with it)\n\n * 5.2.3.x: https://www.ibm.com/docs/en/scalecontainernative/5.2.3 \n * 6.0.1.x:\u00a0 https://www.ibm.com/docs/en/scalecontainernative/6.0.1 \n\n\n\nCSI standalone:\n\n * 2.14.x: https://www.ibm.com/docs/en/scalecsi/2.14.x \n * 3.1.x: https://www.ibm.com/docs/en/scalecsi/3.1.x"
}
],
"title": "IBM Storage Scale Incorrect Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14469",
"datePublished": "2026-11-08T17:26:41.436Z",
"dateReserved": "2026-07-02T14:16:20.602Z",
"dateUpdated": "2026-11-09T18:54:43.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14437 (GCVE-0-2026-14437)
Vulnerability from cvelistv5 – Published: 2026-11-08 17:24 – Updated: 2026-11-09 17:20
VLAI
EPSS
VEX
Title
IBM Storage Scale Path Traversal
Summary
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:20 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291295 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Storage Scale Container Native and CSI |
Affected:
6.0.1.0
(semver)
Affected: 5.2.3.0 , ≤ 5.2.3.9 (semver) cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:* cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:20:27.677679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:20:38.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:5.2.3.9:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_scale:6.0.1.0:*:*:*:*:*:*:*"
],
"product": "Storage Scale Container Native and CSI",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "6.0.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.3.9",
"status": "affected",
"version": "5.2.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e"
}
],
"value": "IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T17:27:45.092Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291295"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eFor IBM Storage Scale Container Native (CSI is bundled with it)\u003c/div\u003e\u003cul\u003e\u003cli\u003e5.2.3.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/5.2.3\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/5.2.3\u003c/a\u003e\u003c/li\u003e\u003cli\u003e6.0.1.x:\u00a0 \u003ca href=\"https://www.ibm.com/docs/en/scalecontainernative/6.0.1\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecontainernative/6.0.1\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003cbr/\u003eCSI standalone:\u003c/div\u003e\u003cul\u003e\u003cli\u003e2.14.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/2.14.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/2.14.x\u003c/a\u003e\u003c/li\u003e\u003cli\u003e3.1.x: \u003ca href=\"https://www.ibm.com/docs/en/scalecsi/3.1.x\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/scalecsi/3.1.x\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "For IBM Storage Scale Container Native (CSI is bundled with it)\n\n * 5.2.3.x: https://www.ibm.com/docs/en/scalecontainernative/5.2.3 \n * 6.0.1.x:\u00a0 https://www.ibm.com/docs/en/scalecontainernative/6.0.1 \n\n\n\nCSI standalone:\n\n * 2.14.x: https://www.ibm.com/docs/en/scalecsi/2.14.x \n * 3.1.x: https://www.ibm.com/docs/en/scalecsi/3.1.x"
}
],
"title": "IBM Storage Scale Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14437",
"datePublished": "2026-11-08T17:24:47.966Z",
"dateReserved": "2026-07-01T21:59:30.877Z",
"dateUpdated": "2026-11-09T17:20:38.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}