IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a CWE-22 improper limitation of a pathname to a restricted directory (path traversal) vulnerability. This flaw enables a remote attacker to write files to arbitrary locations on the system, potentially compromising system integrity and availability. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high impact on integrity and low impact on availability. No vendor advisory or patch information is currently available.

An attacker can remotely write files to arbitrary locations on the affected system, which may allow modification or replacement of critical files, leading to integrity compromise and partial denial of service conditions. Confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for suspicious activity related to file writes.