Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:22.243Z",
  "pubdate": "2026-11-07T05:18:22.243Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability. This security flaw enables a remote authenticated attacker to bypass intended directory restrictions, potentially leading to the unauthorized disclosure of sensitive system information.\nThe vulnerability originates from improper input validation or sanitization mechanisms when processing file system paths. By manipulating input parameters to include directory traversal sequences (e.g., ../), an attacker can access files and directories located outside of the designated application scope. This vulnerability represents a significant risk to data confidentiality and systemic integrity.\nExploitation requires the attacker to possess authenticated access to the target API Connect environment. Successful exploitation grants the attacker the ability to traverse the underlying file system, potentially leading to the extraction of sensitive configuration files, system data, or other restricted information assets that are accessible to the process owner of the API Connect service.",
  "technicalDetails": "The vulnerability resides within the file processing or resource retrieval logic of IBM API Connect, where user-supplied path data is insufficiently sanitized before being used in file system operations. Path traversal (or directory traversal) occurs when an application fails to validate the input path, allowing the inclusion of dot-dot-slash (../) sequences. These sequences allow an attacker to escape the restricted directory and navigate to arbitrary locations within the server's file system.\nThe root cause is a failure in the application's sanitization layer to neutralize malicious character sequences prior to mapping input to a resource identifier or physical file path. In this context, the affected component processes user-provided inputs to locate resources; however, the lack of rigorous canonicalization enables the escalation of access beyond the application root directory.\nThe attack flow proceeds as follows: First, the remote attacker authenticates to the IBM API Connect interface. Second, the attacker identifies an API endpoint or function that accepts a file path or resource identifier as an input parameter. Third, the attacker crafts a malicious request containing traversal sequences designed to escape the application's directory structure. Fourth, the server, failing to properly restrict the input, resolves the malicious path to an unauthorized file on the host operating system. Finally, the server returns the contents of the requested file to the attacker, leading to information disclosure.\nThe attack is limited to the privileges associated with the service account running the IBM API Connect software. Any file readable by the service account within the host's file system becomes a potential target for exfiltration. The scope of the disclosure depends entirely on the file system permissions and the underlying operating system environment. Because the attacker must be authenticated, this vulnerability is not a vector for unauthenticated remote code execution, but it serves as a critical primitive for gathering sensitive system information, credentials, or configuration details that could facilitate further post-exploitation activities or full system compromise.\nAffected versions include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The lack of strict input validation during the construction of file system paths remains the primary vector for this vulnerability."
}