# CVE-2026-18515: IBM i path traversal in Navigator for i

Source: https://junglewise.ai/threats/cve-2026-18515-ibm-i-path-traversal-in-navigator-for-i  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18515 · Severity: medium · CVSS 4.3 · Published 2026-09-14

IBM i Navigator is a web-based administrative interface for managing IBM i systems. A flaw in path validation allows authenticated attackers to upload files to unintended locations on the file system, potentially placing malicious code or configuration files outside areas that should be restricted by Navigator's access controls. The attacker must already have a valid user account and the underlying system profile must have write permissions to the target location.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-18515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18515 being exploited in the wild.

**How severe is CVE-2026-18515?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** IBM I 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-18515?** A patch was published on 2026-09-14: PTF updates available for all affected versions (SJ11196, SJ11197, SJ11200, SJ11187 for Option 3; SJ11377, SJ11376, SJ11375, SJ11374 for Option 34) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18515 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18515?** Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-18515 is a path traversal vulnerability (CWE-22) in IBM i Navigator for i caused by improper validation of file upload paths. An authenticated attacker can craft malicious file upload requests that bypass Navigator's intended directory restrictions through path manipulation, allowing files to be written to arbitrary locations on the file system. The vulnerability requires valid authentication credentials and is network-accessible. An attacker can achieve arbitrary file placement, but only if the compromised user profile already has write permissions to the target directory. Patches are available via PTF updates for IBM i 7.3, 7.4, 7.5, and 7.6.

## Affected products

- IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-09-14: disclosed: Security bulletin published
- 2026-09-14: patched: PTF updates available for all affected versions (SJ11196, SJ11197, SJ11200, SJ11187 for Option 3; SJ11377, SJ11376, SJ11375, SJ11374 for Option 34)

## References

- [https://www.ibm.com/support/pages/node/7286974](https://www.ibm.com/support/pages/node/7286974)

## Related threats

- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)
- [IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass)