IBM MQ Web Console improperly validates file paths, enabling an authenticated administrator to write files outside the designated directory. The flaw can be used to overwrite critical configuration files or inject arbitrary content, which may lead to denial‑of‑service, privilege escalation, or remote code execution. The weakness is a classic path‑traversal flaw as defined in CWE‑22.

IBM MQ Advanced container images and the IBM MQ Operator are affected. Vulnerable releases include IBM MQ Container 10.0.1.0‑r1 and 10.0.0.5‑r2, IBM MQ Advanced 9.4.0.26‑r2 and 9.4.0.5‑r2, and the IBM MQ Operator 4.1.0, 4.0.5, and 3.2.30 along with their associated container images. Users of any of these versions should verify which versions are in their environment to determine if mitigation is required.

The CVSS score of 2.7 categorizes the flaw as low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated administrative access to the Web Console; therefore the attack vector is restricted to environments where such access is already granted. While the risk is relatively low, an attacker who obtains or compromises administrator credentials could use the flaw to modify or overwrite system files.