The vulnerability is a directory traversal flaw (CWE‑22) that allows a local attacker to move outside the intended deployment directory when uploading a crafted application archive. By doing so, the attacker can write arbitrary files to any writable location on the system, potentially overwriting configuration files, inserting malicious code, or creating backdoors. This flaw compromises the integrity of the application server environment and could serve as a foothold for further exploitation.

The flaw affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9. IBM recommends applying the Liberty Fix Pack 26.0.0.10 or any later fix pack, scheduled for availability in October 2026, to mitigate the issue. The affected releases are listed in the advisory and cover a broad range of older Liberty builds.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently rare. The flaw is not included in the CISA KEV catalog. An attacker must have local access to the server to create a malicious archive, so the risk is limited to environments where deployment privileges are mismanaged. However, once exploited, the attacker can write files on the filesystem, which could lead to privilege escalation or persistence if critical files are replaced.