CVE-2026-17088 is a path traversal vulnerability affecting IBM i versions 7.3 through 7.6. This vulnerability allows a remote attacker with authentication privileges to bypass pathname restrictions and access sensitive information outside the intended directory boundaries. The vulnerability is classified under CWE-22 and has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no vendor advisory or patch information available at this time.

A remote authenticated attacker could exploit this vulnerability to obtain sensitive information from the affected IBM i systems by traversing directories beyond the restricted paths. The impact is limited to confidentiality as there is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted authenticated users only and monitor for unusual access patterns related to pathname usage.