IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw that allows a remote authenticated attacker to read arbitrary files on the host. The vulnerability arises from insufficient validation of file paths before accessing file system resources and results in the disclosure of sensitive data, such as configuration files and credentials, thereby compromising confidentiality. The flaw is a classic example of directory traversal (CWE‑22).

The issue affects IBM API Connect deployments running any of these releases: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Organizations using these versions should verify their installed release and assess whether they are exposed to the internet or internal networks with weak role separation.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, so the current public exploitation probability remains unclear, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires remote authentication, an attacker must first gain valid credentials or use social engineering to obtain them. Once authenticated, the attacker can craft requests that alter the requested resource path, read files outside the intended directory, and exfiltrate sensitive information. Given the absence of publicly observed exploits, the immediate risk is limited but not negligible, especially in environments where API Connect is exposed to the internet or internal networks with weak role separation.