IBM App Connect Enterprise exposes a flaw that allows a remote attacker to construct URL paths containing dot‑dot sequences and write arbitrary files to the underlying file system. An attacker can overwrite existing files, inserting malicious content that may lead to system compromise, persistence, or denial of service. The weakness permits both confidentiality and integrity violations by enabling unauthorized file creation and modification.

Versions of IBM App Connect Enterprise from 13.0.1.0 through 13.0.7.2, and from 12.0.1.0 through 12.0.12.27 are affected. The vulnerability persists until the specific fix packs for these branches are applied, namely the 13.0.8.0 release for the 13.x line and the 12.0.12.28 release for the 12.x line.

The CVSS score of 9.8 identifies this as a critical flaw. The EPSS score of <1% indicates a very low, but nonzero, likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Assuming the application is exposed to the internet, an attacker can exploit the defect by sending a crafted HTTP request; the directory traversal is the likely attack vector inferred from the description. Because the flaw permits file writes anywhere on the system, the potential impact is widespread across the affected installations.