A misconfigured PATH environment variable in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 can be abused by an attacker who already has local access to gain elevated privileges. The flaw allows execution of user‑supplied binaries that are found earlier in the search path, leading to privilege escalation. This is a case of CWE‑426, untrusted search path.

IBM Aspera Enterprise WebApps for Linux. Versions 1.0.0 to 1.0.6 inclusive. The vulnerability is present in the specified releases only; newer releases include a fix.

The CVSS base score of 7.8 indicates high severity. EPSS data is not available. The vulnerability is not listed in CISA KEV. The flaw can be exploited by a local attacker who can manipulate the PATH environment variable or place a malicious binary in a directory that precedes trusted directories. Once the environment is modified, any privileged operation that uses standard executables may run the attacker’s code.