IBM InfoSphere Optim Test Data Fabrication versions 1.0.0 through 1.0.2.7 contains a path traversal flaw (CWE‑22) that allows a remote attacker to request files outside the intended directory. The vulnerability arises when the application processes URL paths with '..' segments, enabling the attacker to read arbitrary files present on the host. This can compromise confidentiality of sensitive data such as configuration or log files, and may be leveraged for further exploitation.

All affected releases are listed by IBM: InfoSphere Optim Test Data Fabrication, with versions 1.0.0, 1.0.0.1, 1.0.0.2 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6, and 1.0.2.7. These are the only versions flagged for this flaw and must be reviewed by administrators.

The CVSS score is 7.5, indicating high severity. No exploit probability score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The attacker can trigger the flaw simply by sending a special URL containing '/../' sequences to the application, which is reachable over the network. Because the path traversal is not mitigated by input sanitization, the risk of arbitrary file disclosure remains substantial.