IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote authenticated attacker to request file paths that are not properly validated. The improper validation leads to the server revealing sensitive information such as configuration files or internal data. The weakness is a path traversal error (CWE-22) that can expose confidential data beyond the scope of the authenticated user’s own directories.

Affected products include IBM API Connect v10.0.8.0 to v10.0.8.12 and v12.1.0.0 to v12.1.1.2. These versions are distributed under the IBM API Connect label and listed in the CNA data with corresponding CPE identifiers.

The CVSS score of 7.7 indicates a high severity with medium exploitation difficulty. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. The attack requires remote access to the API Connect instance and valid authentication, after which the attacker can craft requests for arbitrary file paths to read sensitive data. The vulnerability can be mitigated by applying the vendor’s recommended upgrade.