The vulnerability in IBM Planning Analytics Local versions 2.0 and 2.1 allows an attacker who can exploit the file path handling logic to read any file on the host system and to overwrite specific application files. The flaw arises from insufficient validation of paths supplied to the application. An attacker who can supply a crafted file name to the vulnerable component could expose confidential data or alter the application configuration, potentially leading to service disruption or enabling further compromise.

IBM Planning Analytics Local 2.0 and all 2.1 releases up through 2.1.23 are affected. The fix is delivered in version 2.1.24, which is available for download from Fix Central. The Cloud environment has already been remediated.

The CVSS score of 8.2 classifies this as a high‑severity weakness that can be leveraged by a remote attacker to obtain arbitrary file disclosure and to overwrite application files. The EPSS score is not available, yet the absence of a KEV listing suggests no widespread, documented exploitation to date. The attack vector is inferred to be remote, as the description specifies that a remote attacker can initiate the path manipulation through the exposed component. If exploited, the threat includes confidentiality, integrity, and availability impacts because the attacker can read sensitive files and modify application behavior.