The disclosed issue in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allows a remote attacker who has authenticated access to exploit a path traversal flaw, enabling the attacker to read files on the server that should be protected. This leads to potential exposure of configuration data or other sensitive information, as indicated by the CWE‑22 classification.

The vulnerability affects IBM API Connect deployments from version 10.0.8.0 to 10.0.8.12 and from 12.1.0.0 to 12.1.1.2. The affected product is IBM API Connect, specifically the 10.x and 12.x release series. No other vendors are listed, and the specific affected releases are enumerated in the CNA data.

The CVSS score of 7.7 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. The attack route requires an authenticated session; the attacker must first obtain legitimate credentials to target the API Connect instance. Once authenticated, the path traversal can be used to read arbitrary files, potentially exposing sensitive data to the attacker.