IBM API Connect versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 contain a flaw where uploaded content is not properly validated before processing, a classic example of the CWE-434 weakness (Unrestricted File Upload). This missing validation permits a remote authenticated attacker to upload malicious files that are subsequently executed on the server, leading to full code execution and compromise of the affected system.

The vulnerability affects IBM API Connect from version 10.0.8.0 through 10.0.8.12 and from 12.1.0.0 through 12.1.1.2. Users running any of these releases are potentially exposed if they enable file upload functionality.

The severity is high with a CVSS score of 9.9. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to first authenticate to the API Connect instance; once authenticated, the attacker can upload a crafted file that will be processed and executed by the server. Because the flaw is exploitable after authentication, it is a significant concern for environments where privileged users may have access to upload functionality.