IBM Planning Analytics 2.0 and 2.1 contain a directory traversal flaw that can be triggered by a remote attacker through specially crafted URL requests containing "../" sequences. These requests allow the attacker to write arbitrary files to the server’s filesystem, potentially leading to unauthorized code execution, data corruption, or privilege escalation. The vulnerability directly compromises data integrity, confidentiality, and system availability by granting write access where it should be denied.

The affected components are IBM Planning Analytics Local version 2.0 and all versions of the 2.1 series through 2.1.23 inclusive. Versions prior to 2.0 are not reported as vulnerable, while the 2.1.24 update from Fix Central contains the fix. The IBM Planning Analytics Cloud environment has already been remediated and is not impacted by this issue.

With a CVSS score of 7.5, the vulnerability is classified as high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. However, the flaw is remotely exploitable via HTTP requests, and the attack path does not appear to require authentication or elevated privileges, making it highly plausible for attackers to deploy this exploit if a system is exposed to the internet.