IBM Planning Analytics: Path traversal allows file read and overwrite
Summary
IBM Planning Analytics 2.0 and 2.1 (Planning Analytics Local, Workspace component) contain a path traversal flaw caused by improper validation of file paths. A remote attacker can read arbitrary files on the host and overwrite certain application files. The official record gives CVSS 3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which means no authentication or user interaction is required; the IBM bulletin lists 8.1 for the same CWE-22 entry.
Affected
- IBM Planning Analytics Local 2.0 (exact affected builds per IBM bulletin)
- IBM Planning Analytics Local 2.1.0 - 2.1.23
- Unknown: whether further 2.1.x builds are affected
Fixed in
- IBM Planning Analytics Local 2.1.24 (available via IBM Fix Central)
- Unknown: exact fixed version for 2.0; confirm on the IBM bulletin
Workaround
- Unknown from primary sources. Patching is the expected remedy.
Exploitation
- No evidence of exploitation in the wild known at the time of writing.
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
- EPSS approx. 0.0035 (secondary source).
- Not listed in CISA KEV according to a secondary aggregator.
Our recommendation
- Inventory all Planning Analytics Local installations and their versions (2.0 or 2.1.x).
- Plan the upgrade to 2.1.24, or the fix IBM specifies for 2.0, and patch together with the other IBM bulletin fixes.
- Check whether Planning Analytics or Workspace endpoints are reachable from the internet or less-trusted networks, and restrict access.
- Review logs for unusual file access and keep current backups of the application host.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (node/7291604) www.ibm.com
- VulnRichment CVE-2026-19627 vulners.com
- threatint CVE-2026-19627 cve.threatint.com
- Strix CVE-2026-19627 www.strix.ai
- TheHackerWire CVE-2026-19627 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:33.
Original description (NVD)
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.