IBM WebMethods API Gateway fails to validate the URL parameter of the /createapi endpoint, allowing an attacker to supply a file:// URI instead of the expected https:// scheme. This flaw permits reading arbitrary files from the underlying server file system, potentially exposing confidential data, configuration files, or source code. The weakness is a file-path traversal error (CWE-22). The resulting disclosure can compromise system confidentiality.

IBM WebMethods API Gateway (on‑prem) versions 10.11, 10.15, and 11.1 that have not installed the specific vendor‑provided fixes: 10.11_Fix33, 10.15_Fix28, and 11.1_Fix8. Any installation of these products without the stated patches is vulnerable.

The vulnerability scores a CVSS 6.5, indicating moderate severity, and has an EPSS score of less than 1%, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. The attack likely requires the attacker to reach the /createapi endpoint, which may be protected by authentication or network segmentation. If the endpoint is reachable and the attacker can craft the URL parameter, they can read any file the server process can access, giving significant potential impact if privilege escalation is feasible.