This vulnerability (CWE-22) affects IBM i operating system versions 7.3 through 7.6. Due to improper limitation of a pathname to a restricted directory, a remote attacker with authentication privileges can perform path traversal attacks. This enables unauthorized access to sensitive information and file manipulation beyond intended directory boundaries. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An authenticated remote attacker can exploit this flaw to read or modify files outside of authorized directories, potentially leading to unauthorized disclosure of sensitive information and unauthorized file manipulation. There is no indication of impact on system availability or confidentiality compromise beyond file access.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict remote authenticated access to trusted users only and monitor for suspicious file access patterns related to path traversal attempts.