An authenticated user can upload files that contain malicious payloads to IBM Process Mining. If another user opens those files, the embedded code is executed, giving the attacker the ability to run arbitrary commands on the system. This flaw arises from the omission of proper validation of the file types that are accepted for upload (CWE‑434).

IBM Process Mining product versions 2.0.0 through 2.2.1 are affected. The vendor recommends upgrading all affected installations to version 2.2.1 IF001.

The CVSS score of 5.5 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of public exploitation at present. However, the flaw requires an active, legitimate authenticated account to upload a malicious file, and success also depends on another user opening the file. The potential damage is limited to accounts with upload permissions and the systems that process those uploads.