CVE-2026-9035 | BDVDB-2026-335331 Detail
IBMAspera High-Speed Transfer Endpoint
Description#
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.