CVE-2025-36114

HIGH EPSS 36.3%

Published Aug 20, 202510mo ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Aug 20, 2025 10mo ago

Last Modified Jun 17, 2026 2w ago

Description

IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

36.3% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-20 Improper Input Validation Validation

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

Vendor	Product	Version	Range
ibm	soar_qradar_plugin_app	*	≥1.0 – ≤5.6.0

References 1

ibm.com https://www.ibm.com/support/pages/node/7242664

PatchVendor Advisory

Remediation

ibm.com https://www.ibm.com/support/pages/node/7242664

PatchVendor Advisory