CVE-2025-27906
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM Content Navigator versions 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application when using an application URL. Application files and folders become visible in the browser to a user; however, the contents of the files cannot be read or modified.
Risk Assessment
An attacker could learn the file and directory structure of the application, which facilitates further targeted attacks. Disclosure of file names may help identify potentially vulnerable components.
Recommendation
Update IBM Content Navigator to a version containing the fix or contact the vendor to obtain the appropriate patch. Consider restricting access to the application from untrusted networks until the fix is applied.
Other vulnerabilities in IBM Content Navigator
Original NVD description (English source)
IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS