IBM API Connect versions 12.1.0.0 through 12.1.1.2 include a path traversal weakness that allows a remote attacker to read arbitrary files on the host system. By crafting a URL that includes traversal sequences, the attacker can access directories outside the intended repository, potentially exposing confidential or system configuration files. The vulnerability represents a confidentiality compromise without directly enabling code execution or denial of service.

IBM API Connect is affected, specifically the 10.0.8.x series up to 10.0.8.12 and the 12.1.x series up to 12.1.1.2. The strongest recommendation is to migrate to the latest available version—12.1.1.3 for the 12.x branch or 10.0.8.13 for the 10.x branch—to eliminate the flaw.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via HTTP requests, as the flaw is activated by a specially crafted URL. Though the probability of exploitation is currently unknown, the potential loss of sensitive files warrants prompt remediation.