rootpwn

medium · CVSS v3 5.3

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a remote information disclosure via the FileTransfer servlet. An attacker can

Overview

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a remote information disclosure via the FileTransfer servlet. An attacker can retrieve sensitive file system details without authentication. This flaw can aid reconnaissance or further attacks.

Description

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

Impact

Confidentiality is compromised as attackers can view file system metadata and potentially sensitive files. Integrity is not directly affected, but the information can be used to plan further exploits. Availability remains unaffected. Defenders should treat this as a potential foothold for attackers.

Remediation

Apply the latest IBM security patch for WebSphere Application Server that addresses the FileTransfer servlet vulnerability. If patching is delayed, restrict network access to the servlet by firewall rules or disable the FileTransfer feature via configuration. Monitor logs for anomalous file transfer requests.

Risk context

The CVSS v3 score of 5.3 indicates medium risk. No EPSS data is available, so prioritize based on severity and exposure. Timely patching is recommended to mitigate potential reconnaissance.

Affected products

  • IBM WebSphere 9.0
  • IBM WebSphere 8.5

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

IBM WebSphere FileTransfer InformationDisclosure Medium CVE-2026-11540

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

View analysis

medium

CVE-2026-71537

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.

View analysis

medium

CVE-2026-77385

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.

View analysis