IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote attacker to read arbitrary files on the server due to external control of file names or paths. This can expose confidential information such as logs, configuration files or credentials, leading to data exposure and potential further compromise. The weakness is identified as CWE-73, External Control of Filename/Path.

The vulnerability affects installations of IBM API Connect version 12.1.0.0 up to and including 12.1.1.2. Any instance of these revisions is susceptible to the file read vulnerability until the fix is applied in 12.1.1.3.

The CVSS score of 7.5 signals high severity, implying significant confidentiality impact if exploited. The EPSS score is not available, so the quantified likelihood of exploitation is unknown, yet the remote nature of the flaw and the absence of an authentication requirement suggest that an attacker could target the API Connect instance over the network. The vulnerability is not currently listed in the CISA KEV catalog, indicating that widespread exploitation has not been confirmed. The likely attack vector is remote, via the exposed APIs or management interfaces, assuming the environment permits network access to the affected instance.