CVE-2026-13105 is a path traversal vulnerability in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13. The flaw arises from improper limitation of a pathname to a restricted directory, enabling a zip slip attack during configuration import. This can allow an attacker to write files outside the intended directory, potentially leading to full compromise of the affected system. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed yet.

Successful exploitation of this vulnerability can lead to arbitrary file write outside the intended directory, which may result in full system compromise including unauthorized disclosure, modification, or destruction of data. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing untrusted configuration files and monitor for updates from IBM regarding patches or mitigations.