CVE-2025-27906

IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7247854	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:content_navigator:3.0.11:-::::::
	cpe:2.3:a:ibm:content_navigator:3.0.15:-::::::
	cpe:2.3:a:ibm:content_navigator:3.1.0:-::::::
	cpe:2.3:a:ibm:content_navigator:3.2.0:-::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) IBM Content Navigator 3.0.11, 3.0.15, 3.1.0 y 3.2.0 podrían exponer el listado de directorios de la aplicación al usar una URL de aplicación. Los archivos y carpetas de la aplicación son visibles en el navegador para un usuario; sin embargo, el contenido de los archivos no puede ser leído, obtenido o modificado.

Information

Published : 2025-10-14 15:16

Updated : 2026-10-08 12:10

NVD link : CVE-2025-27906

Mitre link : CVE-2025-27906

CVE.ORG link : CVE-2025-27906

JSON object : View

Products Affected

linux

linux_kernel

apple

macos

microsoft

windows

ibm

content_navigator

CWE

CWE-548

Exposure of Information Through Directory Listing

{"id": "CVE-2025-27906", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27906", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T19:09:46.865547Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:content_navigator:3.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:content_navigator:3.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:content_navigator:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:content_navigator:3.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Content Navigator", "versions": [{"status": "affected", "version": "3.0.11"}, {"status": "affected", "version": "3.0.15"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-14T15:16:08.483", "references": [{"url": "https://www.ibm.com/support/pages/node/7247854", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-548"}]}], "descriptions": [{"lang": "en", "value": "IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified."}, {"lang": "es", "value": "IBM Content Navigator 3.0.11, 3.0.15, 3.1.0 y 3.2.0 podr\u00edan exponer el listado de directorios de la aplicaci\u00f3n al usar una URL de aplicaci\u00f3n. Los archivos y carpetas de la aplicaci\u00f3n son visibles en el navegador para un usuario; sin embargo, el contenido de los archivos no puede ser le\u00eddo, obtenido o modificado."}], "lastModified": "2026-10-08T12:10:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:content_navigator:3.0.11:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E22B540-6596-4B59-A703-4BFD89946F8C"}, {"criteria": "cpe:2.3:a:ibm:content_navigator:3.0.15:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "970464FB-088C-4325-8172-39DEC02B9AF3"}, {"criteria": "cpe:2.3:a:ibm:content_navigator:3.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF91A6FA-A5E4-4C15-AA11-A4D1CFBAF440"}, {"criteria": "cpe:2.3:a:ibm:content_navigator:3.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EF33918-7F0E-4034-91F4-950D5D030FD3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}