CVE-2026-6544 describes a vulnerability in IBM Concert versions 1.0.0 through 3.0.0 where recursive directory copying is performed without adequate controls. This flaw can lead to files or directories being accessible to external parties unintentionally, classified under CWE-552. The vulnerability has a CVSS v3.1 base score of 6.2 with an attack vector of local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N/A:N).

The vulnerability allows unauthorized external parties to access files or directories that should not be exposed due to improper recursive copying controls. This can result in confidentiality breaches but does not affect integrity or availability. The attack requires local access but no privileges or user interaction, making it moderately accessible to attackers with local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates. Until a fix is available, restrict local access to systems running affected versions and review directory copying operations to limit exposure.