CVE-2005-1238: By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root,...

Security readout for executives and security teams

This issue means the iSeries AS/400 built-in FTP server may not confine users to a safe document root. A user able to issue FTP file requests could reference full system paths and read or write files outside the expected area, including sensitive QSYS database objects. Exposure is most likely where iSeries or AS/400 FTP is enabled and reachable, especially if administrators rely on a document-root restriction or FTP security gateway behavior. The source bundle does not provide exact affected versions, CPEs, or authentication requirements. Treat as high priority for legacy IBM i environments because it can expose sensitive business data or enable unauthorized file changes. Priority depends on whether FTP is enabled, reachable, and used for sensitive workflows. Mitigation focus: Check IBM and relevant FTP security product guidance for supported controls or fixes.; Disable FTP where it is not operationally required.; Restrict FTP reachability to trusted networks and approved users only..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.