CVE-2026-84275: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Guardium Data Protection

CVE-2026-84275 is a path traversal vulnerability in IBM Guardium Data Protection 12.2 affecting the GIM file-upload feature. An unauthenticated attacker can exploit this vulnerability to write arbitrary files to the Collector, potentially impacting confidentiality. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation allows an unauthenticated attacker to write arbitrary files to the Collector component of IBM Guardium Data Protection 12.2, potentially leading to unauthorized disclosure of sensitive information. The integrity and availability of the system are not directly impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the file-upload functionality and monitor for suspicious activity related to file writes on the Collector.