IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to…

IBM API Connect is a platform organisations use to create, publish, secure and manage their APIs, the interfaces that let applications exchange data. Versions 12.1.0.0 through 12.1.1.2 contain a path traversal weakness. Path traversal means the software does not properly restrict which files or folders a user can reach. An attacker can then step outside the intended directory and read or write files they should not touch.

In this case IBM says the flaw could let a remote attacker who already has an account run arbitrary code, meaning any commands or programs of their choosing, on the affected system. Organisations running these API Connect versions should care, especially if many users, partners or developers have accounts on the platform.

The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory (path traversal). The official description does not name the vulnerable component, endpoint or code path. It states only that the traversal leads to arbitrary code execution. Path traversal typically turns into code execution when an attacker can write or overwrite files in locations the application later loads or runs, such as configuration, scripts or deployable artifacts. The sources do not confirm which mechanism applies here.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The flaw is reachable over the network with low attack complexity. It requires only low privileges, meaning any authenticated account, and no user interaction. The Scope:Changed rating indicates that a successful attack affects resources beyond the vulnerable component itself, for example the underlying host or other managed services. Confidentiality, integrity and availability are all rated High.