IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a CWE-22 path traversal vulnerability due to improper limitation of a pathname to a restricted directory. This flaw could allow a remote attacker with authentication privileges to obtain sensitive information by bypassing file path validation. The CVSS v3.1 base score is 6.5, reflecting a medium severity impact with high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

A remote authenticated attacker could exploit this vulnerability to access sensitive information that should be restricted by the file system path validation. The confidentiality impact is high, but there is no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive data within the affected IBM Db2 Mirror for i installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor IBM's security advisories for updates. No specific temporary mitigations are provided in the available data.