IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
For IBM Storage Scale Container Native (CSI is bundled with it)
- 5.2.3.x: https://www.ibm.com/docs/en/scalecontainernative/5.2.3
- 6.0.1.x: https://www.ibm.com/docs/en/scalecontainernative/6.0.1
CSI standalone:
- 2.14.x: https://www.ibm.com/docs/en/scalecsi/2.14.x
- 3.1.x: https://www.ibm.com/docs/en/scalecsi/3.1.x