IBM Guardium Data Protection 12.1 contains a CWE-22 path traversal vulnerability that permits an administrative user to bypass pathname restrictions by including "dot dot" sequences (/../) in URL requests. This flaw enables writing arbitrary files to locations outside the intended directory scope, potentially compromising system integrity. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to integrity.

An attacker with administrative privileges can exploit this vulnerability to write arbitrary files on the system by leveraging directory traversal sequences in URL requests. This could lead to unauthorized modification of system files or application data, impacting data integrity. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted users only and monitor for suspicious activity related to URL requests containing directory traversal patterns.