Technical impact
The vulnerability allows a remote attacker to submit a specially crafted URL that contains encoded '..' sequences. The IBM Concert web component fails to properly sanitize or validate these sequences, causing the underlying filesystem path to be resolved and the contents of arbitrary files to be returned by the server. This flaw is a classic directory traversal incident (CWE‑22) that can lead to exposure of configuration files, logs, or other sensitive data, thereby compromising confidentiality.
Affected Systems
IBM Concert Software versions 1.0.0 through 3.0.0 are affected, as documented by the reference that states the vulnerability exists in releases up to 3.0.0. Any installation running one of these versions is vulnerable until it is upgraded to 3.0.1.1, which includes the fix.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available while the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation is not yet widespread. The attack requires only an unauthenticated crafted HTTP request, meaning an attacker on the network can send the malicious URL to the Concert application and receive the contents of arbitrary files. No privilege escalation or authentication is required, so the risk is primarily limited to information disclosure.
