Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-07T05:18:43.647Z",
  "pubdate": "2026-11-07T05:18:43.647Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an arbitrary file read vulnerability caused by improper input validation.\nThis vulnerability is classified as an external control of a file name or path, which allows a remote, unauthenticated or authenticated attacker to read sensitive data residing on the underlying server filesystem.\nThe risk implication is critical, as successful exploitation enables the disclosure of sensitive configuration files, system credentials, or application source code.\nThe vulnerability stems from the application's failure to sanitize user-supplied input used in file system operations, allowing for path traversal or direct file access.\nThe attack is performed remotely over the network, requiring no specific user interaction beyond crafting a malicious request. If left unpatched, this vulnerability can lead to full system compromise or facilitate further lateral movement within the network infrastructure.",
  "technicalDetails": "The vulnerability resides in the input processing logic of IBM API Connect, where user-supplied parameters are utilized to construct file paths for server-side file retrieval operations without adequate validation or sanitization.\nThe root cause is the failure to implement path normalization or an allowlist approach for file access, which allows an attacker to influence the file path dynamically. By injecting directory traversal sequences such as '../' or providing absolute paths, an attacker can escape the intended directory scope.\nExploitation involves the manipulation of HTTP request parameters or headers that the application server processes during file system calls. When the application receives the malicious input, it fails to verify that the target file resides within the permitted directory tree.\nThe attack flow begins with the attacker identifying an endpoint that performs file-based operations. The attacker then crafts an HTTP request containing a crafted filename or path, potentially including traversal sequences, to target sensitive files on the host filesystem, such as /etc/passwd or application configuration files containing API keys and database credentials.\nBecause the application performs these operations with the privileges of the service account running the API Connect process, the attacker effectively gains access to any file that the service account is authorized to read.\nThis vulnerability is particularly severe in environments where API Connect is exposed to untrusted networks. The lack of strict input sanitization allows for consistent and reliable retrieval of arbitrary files, resulting in severe confidentiality loss.\nFurthermore, the impact is exacerbated by the potential for automated exploitation scripts to scrape the filesystem for sensitive configuration data, which can then be used to escalate privileges or compromise other integrated systems within the IBM API Connect ecosystem."
}