IBM i versions 7.3 through 7.6 contain a path traversal vulnerability (CWE-22) in Navigator for i that allows a remote authenticated attacker to place files into the file system in locations that should be blocked by Navigator configuration. The vulnerability arises because Navigator does not properly restrict pathnames to allowed directories. Exploitation requires the attacker to have a profile that already permits file placement in the targeted locations, thus the vulnerability extends the ability to bypass Navigator's intended restrictions but does not elevate privileges beyond the attacker's existing rights.

An attacker with valid credentials and sufficient profile permissions can upload files to unauthorized locations within the file system via Navigator for i, potentially bypassing Navigator's configuration restrictions. This could lead to unauthorized file placement, which may facilitate further malicious activity or system misuse. There is no direct impact on confidentiality or availability indicated, and exploitation requires existing privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Navigator for i to trusted users only and review profile permissions to minimize risk. Monitor for unusual file placement activity consistent with this vulnerability.