IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5 contain a CWE-22 path traversal vulnerability. This flaw enables an authenticated user to craft requests that bypass pathname restrictions, potentially allowing arbitrary file writes on the underlying system. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges, causing integrity impact but no confidentiality or availability impact.

An authenticated attacker could exploit this vulnerability to write arbitrary files on the system hosting IBM Db2. This could lead to integrity compromise of the system files or application data. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize risk and monitor for suspicious activity related to file writes.