CVE-2026-18178 is a path traversal vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker with authentication privileges to delete arbitrary files on the system by exploiting improper restrictions on pathname inputs. The vulnerability is classified under CWE-22 and has a CVSS 3.1 score of 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An authenticated remote attacker can delete arbitrary files on affected IBM Db2 Mirror for i systems, potentially disrupting availability of data or services. There is no impact on confidentiality, and integrity impact is limited to file deletion. The vulnerability could cause denial of service or data loss by removing critical files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and monitor for suspicious file deletion activity. No official remediation or temporary fix is currently documented.