Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-07T05:18:44.453Z",
  "pubdate": "2026-11-07T05:18:44.453Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a critical path traversal vulnerability that permits remote code execution. The flaw originates from inadequate input validation during the processing of uploaded content, specifically failing to sanitize file paths effectively. This security deficiency allows an authenticated remote attacker to bypass directory restrictions and perform arbitrary file writes outside of intended, sandboxed, or restricted directories.\nBy manipulating file paths within uploaded data, an attacker can overwrite critical system configuration files, inject malicious scripts into executable paths, or place artifacts in directories that the application executes upon startup or during runtime. The impact of this vulnerability is severe, as it facilitates full system compromise, data exfiltration, or denial of service, depending on the attacker's ability to place and execute arbitrary code. The vulnerability requires the attacker to be authenticated to the target API Connect instance, making it a significant risk for environments where internal users or integrated services may be compromised or malicious.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization of file system paths provided within user-supplied content during file upload operations in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The application fails to perform rigorous validation or canonicalization on file path strings, allowing the use of directory traversal sequences, such as '../', to escape the designated storage directory.\nIn a typical attack flow, an authenticated attacker intercepts or crafts a request containing an upload payload where the filename or path metadata includes traversal characters. Because the underlying file handling component does not enforce absolute path boundaries, the application processes the write operation against a directory path constructed by concatenating the base directory with the attacker's malicious path string. This effectively resolves the file destination to an arbitrary location on the underlying server's filesystem.\nThe exploitation process occurs in several stages: First, the attacker establishes an authenticated session with the target API Connect instance. Second, the attacker initiates an upload sequence, modifying the request metadata to include path traversal sequences intended to target a sensitive system directory, such as an application web root, a library path, or a cron job directory. Third, the application's file processing logic accepts the malicious path and proceeds to write the uploaded file content to the targeted directory.\nPost-exploitation impact is contingent upon the location of the written file. If the attacker targets a directory monitored by the web server, they can achieve arbitrary code execution by uploading a malicious script file (e.g., a JSP, PHP, or other server-side language file supported by the environment) and subsequently requesting its execution via a direct HTTP request. Alternatively, by overwriting existing configuration files, an attacker can modify system behavior, disable security controls, or redirect traffic. The lack of strict path validation allows for persistent compromise, as the malicious file remains on the system until manually removed, enabling future access or execution regardless of the initial session's termination. This vulnerability highlights the necessity of validating all filesystem interactions against a strictly defined allow-list of paths and ensuring that all user-supplied input is treated as untrusted data during file system operations."
}