CVE-2025-13044 is a vulnerability in IBM Concert (versions 1.0.0 through 2.2.0) where temporary files are created with predictable filenames. This predictable naming enables local attackers to create symbolic links that cause the application to overwrite arbitrary files, potentially leading to integrity violations. The vulnerability is classified under CWE-340 (Generation of Predictable Numbers or Identifiers). The CVSS 3.1 base score is 6.2, with attack vector local, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been published by IBM as of the data provided.

The vulnerability allows local users to overwrite arbitrary files via symlink attacks due to predictable temporary file names. This can result in unauthorized modification of files, impacting system or application integrity. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from IBM. Users should monitor IBM advisories for updates. Until a fix is released, restricting local user access and avoiding running IBM Concert on untrusted systems may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.