A path-traversal flaw in IBM API Connect allows a remote authenticated attacker to write files outside the intended directory, leading to arbitrary code execution on the host. This breach can compromise the confidentiality of stored data, alter application state, and potentially disrupt service availability. The weakness stems from insufficient validation of file paths in uploaded content, mapped to CWE-22.

IBM API Connect version 12.1.0.0 through 12.1.1.2 is affected. The vendor recommends upgrading to 12.1.1.3 to mitigate the issue.

The vulnerability carries a CVSS score of 8.8, indicating high severity. Although EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, the attack vector is remote and requires authentication, which is often satisfied in deployed environments. Attackers with valid credentials can exploit the path traversal to drop malicious payloads and execute them, potentially taking full control of the system.