Description
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BMC BMC IT Service Management Suite
Default version status: unknown
25.3.01affected25.3.01 hotfix 10unaffected25.4.01affected25.4.01 hotfix 22unaffected26.1.01affected26.1.01 hotfix 12unaffected
References
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113692/advisory.md ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/ ↗