IBM Content Navigator 3.0.x3.2.0 Directory Listing Disclosure
CVE-2025-27906 Published on October 14, 2025
IBM Content Navigator information disclosure
IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified.
Vulnerability Analysis
CVE-2025-27906 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Exposure of Information Through Directory Listing
A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible.
Products Associated with CVE-2025-27906
Want to know whenever a new CVE is published for IBM Content Navigator? stack.watch will email you.
Affected Versions
IBM Content Navigator:- Version 3.0.11 is affected.
- Version 3.0.15 is affected.
- Version 3.1.0 is affected.
- Version 3.2.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.