CVE-2025-36178 PUBLISHED

Multiple vulnerabilities in IBM Controller

Assigner: ibm
Reserved: 15.04.2025 Published: 18.09.2026 Updated: 18.09.2026

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	IBM
Product	Controller
Versions	affected from 11.0.0 to 11.0.1 FP7 (incl.) affected from 11.1.0 to 11.1.3 FP1 (incl.)

Solutions

It is strongly recommended that you apply the most recent security updates:

Affected Product(s)Version(s)FixIBM Cognos Controller11.0.0 - 11.0.1 FP7 https://www.ibm.com/mysupport . Customers currently running IBM Controller 11.0 and 11.1 can upgrade to the 11.2 release stream at no additional charge.

References

https://www.ibm.com/support/pages/node/7287970

Problem Types

CWE-1284 Improper Validation of Specified Quantity in Input CWE