# CVE-2025-36074: IBM Security Verify Directory unrestricted file upload

Source: https://junglewise.ai/threats/cve-2025-36074-ibm-security-verify-directory-unrestricted-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-36074 · Severity: medium · CVSS 5.5 · Published 2026-04-23

IBM Security Verify Directory, a tool used for managing identity and access data, is vulnerable to a security flaw where it fails to properly check the types of files being uploaded. A user with high-level administrative privileges could upload harmful files to the system, which could then be used to launch further attacks against other users or the system itself. This could lead to unauthorized changes to system data or disruptions in service.

Technologies: [IBM Security Verify Directory](https://junglewise.ai/threats/technologies/security-verify-directory). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36074 being exploited in the wild.

**How severe is CVE-2025-36074?** Medium severity, with a CVSS score of 5.5, published 23 April 2026.

**Which products and versions are affected?** IBM Security Verify Directory 10.0.0 - 10.0.0.3.

**Is there a fix for CVE-2025-36074?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-36074 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-36074?** Check whether you run IBM Security Verify Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 are vulnerable to an unrestricted file upload (CWE-434). The root cause is a failure to validate file types during the upload process. An attacker with high privileges (PR:H) can upload malicious files via the network. While the primary impact is on integrity, these files can be leveraged to target other victims or perform secondary attacks against the system infrastructure. IBM has released version 10.0.4 to address this vulnerability.

## Affected products

- IBM Security Verify Directory (Container) 10.0.0 - 10.0.0.3

## Timeline

- 2026-04-08: advisory: Initial publication by IBM
- 2026-04-22: disclosed: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7268907](https://www.ibm.com/support/pages/node/7268907)

## Related threats

- [IBM Security Verify Directory credential exposure in GET requests](https://junglewise.ai/threats/cve-2026-8860-ibm-security-verify-directory-10-0-0-through-10-0-4-and-ibm-verify)
- [IBM Security Verify Directory information disclosure via debug endpoints](https://junglewise.ai/threats/cve-2026-8642-ibm-security-verify-directory-10-0-0-through-10-0-4-and-ibm-verify)
- [IBM Security Verify Directory session fixation in Web Application](https://junglewise.ai/threats/cve-2026-8639-ibm-security-verify-directory-10-0-0-through-10-0-4-and-ibm-verify)