Executive brief
IBM Controller is a business performance management application used for financial consolidation and reporting. An authenticated attacker could bypass file upload validation checks by manipulating client-side file size parameters, potentially allowing unauthorized file uploads or modifications that could compromise data integrity or enable further attacks on the system.
Technical details
The vulnerability is an improper input validation flaw (CWE-1284) in IBM Controller's file upload functionality. The application fails to properly validate file size constraints on the server side, relying instead on client-side validation that an authenticated attacker can circumvent. The attack requires valid user credentials but no special privileges or user interaction. By tampering with file size metadata submitted to the server, an attacker can bypass intended upload restrictions, potentially uploading files larger than policy allows or with unexpected content. The vulnerability affects versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1; upgrading to version 11.2.0 resolves the issue.
Affected products
- IBM Controller 11.0.0 through 11.0.1 FP7, 11.1.0 through 11.1.3 FP1
Timeline
- 2026-09-18: disclosed