CVE-2026-15280 Path traversal in WebSphere Application Server - Liberty
Attackers can exploit path-segment injection in the collective routing mechanism to achieve remote code execution and access files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15280?
CVE-2026-15280 is a high-severity path traversal vulnerability in Ibm Websphere Application Server, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
Weakness: CWE-22
Which versions are affected by CVE-2026-15280?
It affects 1 product.
Products include Ibm Websphere Application Server.
How do I fix CVE-2026-15280?
No fix has been published for CVE-2026-15280 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15280 being exploited?
There is no known exploitation of CVE-2026-15280 in the wild and no public exploit code.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as GHSA-w4jw-g5gv-m8gf.