The vulnerability allows an attacker to bypass authorization controls when uploading data to a remote object storage path that contains a specific, crafted query string. It is classified as CWE‑285, meaning the attacker can gain access without proper credentials. Successful exploitation would let a malicious actor upload files or execute code under the database context, potentially compromising data confidentiality, integrity, and availability.

All IBM Db2 12.1.0 through 12.1.4 releases are affected. The issue was identified in the 12.1 version line, and any installed instance within that range is vulnerable.

The CVSS score of 6.5 indicates medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit this remotely by uploading data to a configured object storage endpoint with a special query string, provided the database is exposed to the network and remote storage uploads are allowed. Because it bypasses authorization checks, it could elevate privileges or tamper with data if the attacker can reach the vulnerable upload path. No publicly documented exploits exist yet, but the ability to bypass authorization suggests potential for misuse.