CVE-2025-25048

MEDIUM

IBM Jazz Foundation <7.0.2-7.1.0 - Privilege Escalation

Title source: llm

Description

IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.

References (1)

[Patch, Vendor Advisory] https://www.ibm.com/support/pages/node/7244014

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 10.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-23

Status published

Products (3)

ibm/jazz_foundation 7.0.2 (32 CPE variants)

ibm/jazz_foundation 7.0.3 (13 CPE variants)

ibm/jazz_foundation 7.1.0 (3 CPE variants)

Published Sep 04, 2025

Tracked Since Feb 18, 2026