{"id":"CVE-2025-36183","aliases":["EUVD-2025-207803","GHSA-mw8p-6vj4-pvjr"],"status":"published","title":"Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data","description":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00215,"percentile":0.12019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-02-17T21:32:26Z","modified":"2026-06-17T09:14:34Z","products":[{"vendor":"ibm","product":"watsonx.data"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7260118","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36183"},{"url":"https://github.com/advisories/GHSA-mw8p-6vj4-pvjr"}],"sources":{"cve":[{"id":"CVE-2025-36183","title":"Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data","description":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.","status":"published","published":"2026-02-17T21:32:26.015Z","modified":"2026-02-18T20:36:53.178Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-207803","description":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.","status":"published","published":"2026-02-17T21:32:26Z","modified":"2026-02-18T20:36:53Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T19:48:37.43406Z"}],"ghsa":[{"id":"GHSA-mw8p-6vj4-pvjr","title":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload...","description":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.","status":"published","published":"2026-02-18T00:30:16Z","modified":"2026-02-18T00:30:22Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:06:14.396911Z"}],"nvd":[{"id":"CVE-2025-36183","description":"IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.","status":"published","published":"2026-02-17T22:18:43.62Z","modified":"2026-06-17T09:14:34.96Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:00.273026Z"}]}}