CVE-2025-36074 describes an unrestricted file upload vulnerability in IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3. The product fails to validate the type of files uploaded by privileged users, potentially allowing malicious files to be introduced into the system. This could facilitate further attacks against the system or its users. The vulnerability is classified under CWE-434 and carries a CVSS 3.1 base score of 5.5, indicating medium severity. No patch or official remediation level has been disclosed, and the product is not a cloud service, so remediation depends on IBM's future updates.

The impact of this vulnerability is that a privileged user could upload malicious files into the IBM Security Verify Directory system. These files could then be used to perform further attacks against the system or its users. The CVSS vector indicates no confidentiality impact but a high integrity impact and low availability impact. There are currently no known exploits in the wild, and no direct evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published by IBM, organizations should restrict privileged user access to trusted personnel only and monitor for suspicious file uploads. Follow IBM's advisories closely for updates on patches or mitigations.