Executive brief
IBM Db2 is a database server and client software suite used by enterprises to store and manage critical data. A flaw in the Db2 JDBC/SQLJ client driver allows a malicious database server to write arbitrary files on a client computer, potentially enabling data theft, malware installation, or operational disruption. This vulnerability affects versions 11.5.0–11.5.9 and 12.1.0–12.1.5 on Linux and Unix systems.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the IBM Db2 JDBC and SQLJ client driver that fails to properly validate file paths. An attacker controlling a malicious Db2 server can exploit this during client connection to write arbitrary files on the connected client system. The attack is network-accessible, requires no user interaction, and operates over the standard database connection protocol. No authentication is required at the application level; the attacker must control or compromise the server itself. Patches are available for affected versions (11.5.9, 12.1.4, and 12.1.5) via IBM Support security updates.
Affected products
- IBM Db2 11.5.0–11.5.9, 12.1.0–12.1.5
Timeline
- 2026-09-14: disclosed: IBM security bulletin published