IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw (CWE‑22) that enables a remote attacker who has authenticated to the service to read files outside the intended directory structure. This vulnerability can be used to expose configuration files, user data, or other sensitive information, compromising confidentiality. The issue arises because the application accepts user-supplied paths without proper validation or normalization, allowing traversal characters to escape the sandboxed directory.

The affected products are IBM API Connect for the 10.0.8 and 12.1.x product lines. The vulnerable releases are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Any deployment of these versions is at risk until it is updated to a fixed release.

The CVSS score of 8.5 places this vulnerability in the high severity range. While the EPSS score is not available, the flaw requires authenticated access, meaning attackers must first compromise legitimate credentials. The lack of listing in the CISA KEV catalog suggests no widespread public exploitation has been reported yet, but the high severity and path traversal nature make it a candidate for targeted attacks against exposed services. Existing authentication mechanisms should not mask the risk, and the vulnerability could be leveraged to exfiltrate any files the authenticated user is permitted to access.