IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a path traversal flaw (CWE‑22). An attacker who has authenticated credentials can supply a malicious path that resolves to arbitrary disk locations, enabling the download or view of files that contain confidential data. This results in a data confidentiality breach and could expose system configuration or user credentials to the attacker.

IBM rate this vulnerability applies to IBM API Connect, specifically the 10.x series from 10.0.8.0 to 10.0.8.12 and the 12.x series from 12.1.0.0 to 12.1.1.2. The security notice also references the newer releases 10.0.8.13 and 12.1.1.3 as the patching targets.

The CVSS score is 8.5, indicating high severity. EPSS data is not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector for exploitation is inferred to be remote, authenticated access to the API Connect web interface; the attacker must possess valid credentials to trigger the path traversal. Given the lack of publicly known exploits, the likelihood of immediate exploitation is uncertain, but the high severity warrants prompt remediation.