Read the docs
TI-2022-06705 Aliases CVE-2022-22392GHSA-8973-w8wf-mxh6

Unrestricted file upload in IBM Planning Analytics Workspace

Priority LOW 38CWE-434Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066.

Why it matters now

EPSS 0.02068 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPlanning Analytics Workspace2.0—No fix listedCNA
  • Planning Analytics Workspace VendorIBM Affected 2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:*2.0VulnerableIBM
  • cpe:2.3:a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22392
  2. 2026-10-03 Alias added: GHSA-8973-w8wf-mxh6

References

Advisory 1

  • TI-2024-23224 IBM Planning Analytics Local missing authentication CVSS 3.1CRITICAL 9.1
  • TI-2025-24804 IBM Planning Analytics Local Directory Traversal CVSS 3.1HIGH 8.0
  • TI-2021-16460 Unrestricted file upload in IBM Planning Analytics Workspace CVSS 3.1HIGH 8.0
  • TI-2025-24785 IBM Planning Analytics Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2022-06644 IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read… CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences