ByteOS Network

NVD Vulnerability Details :

CVE-2025-36357

Analyzed

Source-psirt@us.ibm.com

Published At-17 Nov, 2025 | 20:15

Updated At-19 Nov, 2025 | 13:08

IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.0

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CPE Matches

IBM Corporation

>>planning_analytics_local>>Versions from 2.1.0(inclusive) to 2.1.15(exclusive)

cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*

IBM Corporation

>>planning_analytics_workspace>>Versions from 2.1.0(inclusive) to 2.1.15(exclusive)

cpe:2.3:a:ibm:planning_analytics_workspace:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-36	Primary	psirt@us.ibm.com

CWE ID: CWE-36

Type: Primary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7251265	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7251265

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History