CVE-2025-3356 IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations

What is CVE-2025-3356?

CVE-2025-3356 is a high-severity path traversal vulnerability in IBM Tivoli Monitoring, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.

Weakness: CWE-22

Which versions are affected by CVE-2025-3356?

It affects 1 product.

Products include Ibm Tivoli Monitoring.

How do I fix CVE-2025-3356?

No fix has been published for CVE-2025-3356 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-3356 being exploited?

There is no known exploitation of CVE-2025-3356 in the wild and no public exploit code.

Other vulnerabilities in IBM Tivoli Monitoring

• CVE-2015-7411 Privilege escalation in n/a Critical 9.9
• CVE-2025-3357 IBM Tivoli Monitoring code execution Critical 9.8
• CVE-2017-1789 Code injection in Tivoli Monitoring V6 Critical 9.8
• CVE-2015-5003 Command injection in n/a High 8.5
• CVE-2014-6141 Privilege escalation in n/a High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fw76-qjj6-w857.