CVE-2026-13105: IBM i Access Client Path Traversal Flaw

CVE-2026-13105 Overview

CVE-2026-13105 is a zip slip path traversal vulnerability [CWE-22] affecting IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13. The flaw exists in the configuration import functionality, where the application fails to validate file paths inside archive files before extraction. An attacker can craft a malicious configuration archive that writes files outside the intended extraction directory. Successful exploitation requires user interaction, specifically the import of an attacker-supplied configuration file. Exploitation can lead to arbitrary file write, which may result in code execution in the context of the user running IBM i Access Client Solutions.

Critical Impact
Attackers can write arbitrary files to sensitive locations on the host, enabling code execution and full compromise of confidentiality, integrity, and availability.

Affected Products

IBM i Access Client Solutions 1.1.2.0
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13
IBM i Access Client Solutions configuration import component

Discovery Timeline

2026-08-12 - CVE CVE-2026-13105 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-13105

Vulnerability Analysis

The vulnerability is a classic zip slip issue in the configuration import routine of IBM i Access Client Solutions. When a user imports a configuration archive, the application extracts archive entries without sanitizing embedded path traversal sequences. An attacker who controls the archive can include entries with names such as ../../../../ sequences that escape the intended extraction directory. The extraction routine then writes attacker-controlled content to arbitrary paths reachable by the current user's privileges. On Windows hosts, this can include startup folders, DLL search paths, or scheduled task definitions used for persistence and code execution.

Root Cause

The root cause is missing validation of archive entry paths before file write operations, categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The extraction logic trusts the file names contained in the imported archive and does not canonicalize the resolved output path against the target extraction directory. See the IBM Security Advisory for vendor-supplied technical details.

Attack Vector

Exploitation is network-based but requires user interaction. An attacker delivers a crafted configuration archive through email, a compromised website, or a shared file location. When the target user imports the archive via IBM i Access Client Solutions, extraction writes malicious files to attacker-chosen paths. No authentication to the vulnerable client is required prior to exploitation. Refer to the IBM Security Advisory for exploitation prerequisites documented by the vendor.

Detection Methods for CVE-2026-13105

Indicators of Compromise

Unexpected file writes originating from the IBM i Access Client Solutions process outside of its normal install and profile directories.
Configuration archive files containing entries with ..\ or ../ path traversal sequences in their internal file names.
New executables, DLLs, or scripts appearing in Windows startup folders shortly after a configuration import event.

Detection Strategies

Inspect imported configuration archives statically for entries whose normalized paths resolve outside the intended extraction directory.
Monitor for the IBM i Access Client Solutions process writing to sensitive system locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.
Correlate configuration import activity with subsequent process creation from unexpected file paths.

Monitoring Recommendations

Enable file integrity monitoring on user profile directories, startup folders, and application data paths touched by IBM i Access Client Solutions.
Log endpoint process telemetry for child processes spawned by the IBM i Access Client Solutions binary.
Alert on execution of files written within a short time window following a configuration import.

How to Mitigate CVE-2026-13105

Immediate Actions Required

Upgrade IBM i Access Client Solutions to the fixed version identified in the IBM Security Advisory.
Restrict configuration imports to files obtained from trusted internal sources only.
Educate users on the risk of importing configuration archives received via email or untrusted channels.

Patch Information

IBM has published remediation guidance in the IBM Security Advisory. Administrators should apply the vendor-supplied update that supersedes vulnerable versions 1.1.2.0 through 1.1.9.13.

Workarounds

Block delivery of IBM i Access Client Solutions configuration archives at the email gateway when not required for business operations.
Run IBM i Access Client Solutions as a standard user with no write access to system-wide directories to reduce exploitation impact.
Use application allowlisting to prevent execution of unexpected binaries written by the client process.

bash

# Example: identify installed IBM i Access Client Solutions version on Windows
reg query "HKLM\SOFTWARE\IBM\Client Access Express" /v Version