CVE-2025-14914

🗓️ 02 Feb 2026 15:17:57Reported by ibmType

WebSphere Liberty versions 17.0.0.3 through 26.0.0.1 allow privileged users to upload zip archives with path traversal, overwriting files and executing arbitrary code.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a remote code execution vulnerability (CVE-2025-14914)	9 Feb 202614:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2025-14914, CVE-2025-12635)	25 Mar 202606:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Application Service for Java is affected by a remote code execution vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-14914)	27 Feb 202615:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution vulnerability (CVE-2025-14914)	30 Jan 202621:13	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities may affect IBM WebSphere Liberty and Expat that are shipped with IBM CICS TX Standard.	24 Mar 202613:54	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for May 2026.	1 Jun 202610:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Extender Advanced is affected by a IBM WebSphere Application Server Liberty vulnerability	4 Mar 202609:48	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms (CVE-2025-12635 and CVE-2025-14914).	20 Mar 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by security bypass, denial of service, cross-site scripting and remote code execution vulnerabilities due to WebSphere Application Server Liberty	17 Mar 202612:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager v4 is impacted by multiple vulnerabilities in WebSphere Application Server Liberty	12 May 202617:33	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange17.0.0.3–26.0.0.1liberty

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:17.0.0.3:*:*:*:liberty:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:25.0.0.7:*:*:*:liberty:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "WebSphere Application Server Liberty",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "26.0.0.1",
        "status": "affected",
        "version": "17.0.0.3",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7258224

12 Feb 2026 21:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.6

EPSS0.00015

SSVC

CWE-22