An attacker with local access to the IBM App Connect Enterprise environment can exploit improper validation of pathname components during archive extraction to write to arbitrary files on the system. This flaw, classified as CWE-22, enables the attacker to overwrite configuration files, replace binaries, or place malicious payloads, potentially leading to privilege escalation, denial of service, or further compromise. The vulnerability does not provide remote code execution on its own but grants the ability to manipulate the file system where the application is running.

IBM App Connect Enterprise versions from 12.0.1.0 through 12.0.12.29 and from 13.0.1.0 through 13.0.8.2 are affected. The IBM Technical Assistance Request (IT50104) provides a fix, and the corresponding Fix Pack releases are 12.0.12.30 for the 12.x line and 13.0.9.0 for the 13.x line.

The CVSS score of 5.5 places the flaw in the medium severity range, indicating that while the attack requires local access, the potential damage is significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely known to have exploitable public exploits at this time. Nevertheless, local attackers who can place or modify archives processed by the application remain at risk because the lack of pathname validation allows arbitrary file placement.