IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a CWE-22 path traversal vulnerability that allows remote attackers to write arbitrary files on the system. This occurs because the software does not properly validate file path inputs, enabling attackers to escape restricted directories and write files to unintended locations. The vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 3.1 base score is 7.5, reflecting high impact on integrity but no impact on confidentiality or availability.

An attacker can remotely write arbitrary files on the affected system, potentially leading to unauthorized modification of data or code. This could facilitate further attacks such as privilege escalation or persistence. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Db2 service to trusted users only and monitor for suspicious activity related to file writes. Do not rely on generic mitigations as the vulnerability specifically involves improper path validation.