Read the docs
TI-2021-16460 Aliases CVE-2021-39040GHSA-7v8x-4fxf-3hxx

Unrestricted file upload in IBM Planning Analytics Workspace

Priority LOW 36CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 214025.

Why it matters now

EPSS 0.00777 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPlanning Analytics Workspace2.0—No fix listedCNA
  • Planning Analytics Workspace VendorIBM Affected 2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:*2.0VulnerableIBM
  • cpe:2.3:a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39040
  2. 2026-10-03 Alias added: GHSA-7v8x-4fxf-3hxx

References

Advisory 1

  • TI-2024-23224 IBM Planning Analytics Local missing authentication CVSS 3.1CRITICAL 9.1
  • TI-2025-24804 IBM Planning Analytics Local Directory Traversal CVSS 3.1HIGH 8.0
  • TI-2022-06705 Unrestricted file upload in IBM Planning Analytics Workspace CVSS 3.1HIGH 7.8
  • TI-2025-24785 IBM Planning Analytics Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2022-06644 IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read… CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences