CVE-2026-18133 is a path traversal vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0. This vulnerability allows a remote attacker with authentication privileges to manipulate server files by bypassing pathname restrictions. The flaw is categorized under CWE-22, indicating improper limitation of a pathname to a restricted directory. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts.

An authenticated remote attacker can exploit this vulnerability to modify server files, potentially impacting the integrity and availability of the IBM Financial Transaction Manager service. There is no confidentiality impact reported. No known exploits are currently in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious activity related to file modifications.