IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote attacker to construct a URL that resolves to directories outside the intended file system context. This flaw permits reading of arbitrary files on the underlying host, potentially exposing sensitive configuration, credentials or code. It is classified as CWE‑22, a path traversal weakness that can compromise confidentiality.

The vulnerability affects IBM API Connect, specifically the 10.0.8 series (10.0.8.0–10.0.8.12) and the 12.1 series (12.1.0.0–12.1.1.2). The remediation recommends upgrading to 12.1.1.3 or to 10.0.8.13.

The CVSS base score of 6.5 indicates moderate severity. Exploitation requires a remote attacker to send a crafted HTTP request directly to the API Connect instance. No EPSS probability is available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known public exploits at this time, but the risk of confidential data exposure remains significant if the service is reachable from untrusted networks.