CVE-2025-0823: IBM Cognos Analytics Path Traversal Flaw

CVE-2025-0823 Overview

CVE-2025-0823 is a path traversal vulnerability [CWE-22] in IBM Cognos Analytics. The flaw affects versions 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4. A remote authenticated attacker can send a specially crafted URL containing ../ sequences to read arbitrary files on the host system. Successful exploitation exposes configuration files, credentials, and other sensitive data stored on the server. IBM published a security bulletin and corresponding fix through the IBM Support Page for Node 7183676.

Critical Impact
Authenticated remote attackers can read arbitrary files from the Cognos Analytics server, potentially exposing credentials, configuration, and business intelligence data.

Affected Products

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5
IBM Cognos Analytics 12.0.0 through 12.0.4
IBM Cognos Analytics 12.0.4 including Interim Fix 1

Discovery Timeline

2025-02-28 - CVE-2025-0823 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0823

Vulnerability Analysis

The vulnerability resides in URL request handling within IBM Cognos Analytics. The application fails to properly canonicalize and validate user-supplied path components before resolving them against the server filesystem. As a result, an attacker with low-level authenticated access can inject ../ (dot dot slash) sequences to escape the intended directory scope. The impact is limited to confidentiality; the flaw permits reading files but does not directly enable modification or code execution. Because Cognos Analytics frequently runs with access to database credentials, connection strings, and enterprise data source configuration, disclosed files often accelerate follow-on attacks against adjacent systems.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-22]. The affected request handler does not reject or normalize traversal sequences before appending user-controlled segments to a base directory path. This allows references such as /../../../etc/passwd or Windows equivalents to resolve outside the intended web root.

Attack Vector

Exploitation requires network access to the Cognos Analytics web interface and valid low-privilege credentials. An attacker crafts an HTTP request containing traversal sequences within a vulnerable URL parameter. The server processes the request, resolves the manipulated path, and returns file contents in the response. No user interaction is required beyond the attacker's own authenticated session. Refer to the IBM security bulletin for vendor-confirmed technical details.

Detection Methods for CVE-2025-0823

Indicators of Compromise

HTTP request logs containing ../, ..%2f, ..\, or double-encoded traversal patterns targeting Cognos Analytics endpoints.
Unexpected access to system files such as /etc/passwd, /etc/shadow, or Windows configuration files originating from the Cognos service account.
Authenticated sessions issuing high volumes of unusual URL requests to file-serving endpoints.

Detection Strategies

Deploy web application firewall (WAF) rules that flag encoded and unencoded directory traversal sequences on requests to /bi/ and related Cognos paths.
Correlate authenticated Cognos session activity with filesystem read patterns on the underlying host.
Baseline normal Cognos URL structures and alert on deviations that include parent directory references.

Monitoring Recommendations

Enable verbose access logging on the Cognos Analytics dispatcher and forward logs to a centralized analytics platform.
Monitor process-level file access by the Cognos service account for reads of sensitive configuration files.
Alert on 200-status responses to requests containing traversal patterns, indicating successful file disclosure.

How to Mitigate CVE-2025-0823

Immediate Actions Required

Upgrade IBM Cognos Analytics to a fixed release as documented in the IBM security bulletin.
Restrict access to the Cognos Analytics web interface to trusted networks and authenticated users only.
Rotate any credentials, API keys, or connection strings that may have been readable from the Cognos filesystem.

Patch Information

IBM has published remediation guidance and fix availability in the IBM Support Page for Node 7183676. Administrators running 11.2.x should upgrade beyond 11.2.4 FP5, and 12.0.x deployments should upgrade beyond 12.0.4 per IBM's documented fix pack path.

Workarounds

Place a WAF or reverse proxy in front of Cognos Analytics with rules that block requests containing directory traversal sequences.
Enforce least-privilege file permissions on the Cognos server so the service account cannot read sensitive system files.
Limit authenticated Cognos accounts to the minimum required roles to reduce the attack surface for low-privilege exploitation.

bash

# Example WAF rule concept (ModSecurity) to block traversal on Cognos endpoints
SecRule REQUEST_URI "@rx (\.\./|\.\.%2f|\.\.\\)" \
    "id:1000823,phase:1,deny,status:403,msg:'CVE-2025-0823 path traversal attempt'"