SB2026100111 - Multiple vulnerabilities in IBM Edge Data Collector
Published: October 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Path traversal (CVE-ID: CVE-2026-11940)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. A remote attacker can use malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes.
2) Link following (CVE-ID: CVE-2025-4330)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an insecure link following issue when extracting data from an archive in the tarfile module. A remote attacker can pass a specially crafted archive to the application and overwrite arbitrary files outside the destination directory.
3) Information Exposure Through an Error Message (CVE-ID: CVE-2026-69247)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover plaintext from PKCS#7 EnvelopedData messages.
The vulnerability exists due to generation of error message containing sensitive information and observable timing discrepancy in pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime when decrypting attacker-supplied EnvelopedData. A remote attacker can send crafted EnvelopedData messages and observe distinguishable errors and timing differences to recover plaintext from PKCS#7 EnvelopedData messages.
Exploitation requires a service that automatically decrypts untrusted EnvelopedData for the victim certificate and returns adaptive responses at high volume.
4) Improper Certificate Validation (CVE-ID: CVE-2026-69248)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to spoof certificate identity validation.
The vulnerability exists due to improper certificate validation in the certificate verifier when processing certificate chains with wildcard DNS subject alternative names under permitted subtrees constraints. A remote attacker can present a specially crafted certificate chain to spoof certificate identity validation.
The issue occurs when an intermediate constrained CA permits a specific DNS name such as foo.example.com, but a leaf certificate uses a broader wildcard DNS SAN such as *.example.com.
5) Resource exhaustion (CVE-ID: CVE-2026-69249)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the certificate chain path-building logic when processing invalid certificate chains containing duplicate self-signed certificates. A remote attacker can supply a crafted certificate chain to cause a denial of service.
The issue affects availability only; certificate validation correctness is not affected.
Remediation
Install update from vendor's website.