IBM i OpenSSH mis‑enforces the ChrootDirectory directive, allowing a remote authenticated user to escape the intended sandbox and access files and commands outside the designated directory. Because the system believes the user is confined when it is not, the attacker can elevate privileges, compromising confidentiality, integrity, and potentially availability of the affected system.

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected. Patches are available as part of IBM i Release5733‑SC1, with specific PTFs SJ11849, SJ11850, and SJ11852 for each release. Unsupported versions should be upgraded to a supported fixed release.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote authenticated session in OpenSSH; an attacker must first obtain valid credentials for an account that is permitted to use SSH. Once authenticated, the attacker can manipulate the misconfigured ChrootDirectory to gain elevated privileges, thereby accessing unauthorized files and executing unintended commands. The risk is therefore constrained to environments where credentials are compromised or weak, but the impact remains significant once bypassed.