CVE-2026-17181 is a path traversal flaw in the IBM Db2 Mirror for i GUI, versions 7.4, 7.5 and 7.6. It scores 9.3, Critical, and lets a remote attacker with no credentials write files to arbitrary locations. IBM fixes it with PTF SJ10947 on 7.4, SJ10961 on 7.5 and SJ10948 on 7.6.
What's affected
IBM Db2 Mirror for i 7.4, 7.5 and 7.6, licensed program 5770-DBM. IBM's bulletin covers the Db2 Mirror for i GUI and fixes the full list of issues in it with one PTF per release:
- 7.4: PTF SJ10947
- 7.5: PTF SJ10961
- 7.6: PTF SJ10948
IBM recommends addressing the vulnerabilities now and lists no workaround. The same bulletin lists 18 CVEs, so this PTF closes a lot more than one issue.
The record scores it 9.3 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L. IBM's own bulletin gives the same 9.3 and the same vector, with changed scope and high integrity impact.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770DBM) SELECT(SJ10947)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
Use SJ10961 on 7.5 and SJ10948 on 7.6. If you do not run Db2 Mirror for i at all, there is nothing to patch, but confirm that rather than assume it.
What to do now
- Find every IBM i partition that runs Db2 Mirror for i 7.4, 7.5 or 7.6.
- Load and apply the PTF for your release: SJ10947, SJ10961 or SJ10948.
- Check which network segments can reach the Db2 Mirror GUI. This flaw needs no login, so reduce who can reach the interface while you schedule the change.
- Review the other CVEs in the same IBM bulletin, because several score 9.8 or 9.9 and the same PTF covers them.
- Look at file creation and change events on the partition around the period the system was exposed, as a precaution. The advisory does not report exploitation.
Why it matters
The record classes the weakness as CWE-22, Improper Limitation of a Pathname to a Restricted Directory (path traversal). Path traversal means the application builds a file path from input it does not clean, so special sequences in the input can steer the path out of the intended directory. Here the effect is writing, not reading: IBM says a remote attacker could write files to arbitrary locations. The vector rates integrity impact high and availability impact low, and it needs no privileges and no user interaction.
An arbitrary file write on a management interface is serious because files can be placed where a program will later load or run them. The record does not describe that path, and we are not going to guess at it. What is sound to say is that the change of scope in the vector reflects impact beyond the GUI component itself.
This is one of several severe items in a single bulletin. Others include command injection, authentication bypass and a file-path code execution issue, all in the same GUI. If your team triages by CVE, collapse them into one change: the PTF is the same.
Quick check
Does the PTF fix only this CVE?
No. IBM's bulletin lists 18 CVEs for the Db2 Mirror for i GUI, and the PTFs for each release are the remediation for all of them.
Is there a workaround?
IBM lists none. Limiting network reach to the GUI is a sensible interim control, but it is not a fix.
Sources
- IBM Security Bulletin 7283359: Db2 Mirror for i, fetched 18 October 2026
Last reviewed: 18 October 2026.
