{"id":"CVE-2026-17335","published":"2026-11-07T05:18:44.453","lastModified":"2026-11-09T15:17:19.990","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability (CWE-22) in file upload handling, allowing an authenticated attacker to write files outside the intended directory and potentially achieve remote code execution.","exploitability":"Exploitation requires valid authentication and the ability to upload content with manipulated file paths, but no UI interaction or complex conditions are needed beyond basic HTTP access.","blast_radius":"Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts on the affected API Connect management plane.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for CVE-2026-17335.","detection":"Defenders should monitor for anomalous file creation outside expected upload directories (e.g., in parent or sibling folders of /opt/ibm/api-connect/upload) in application logs or filesystem audit trails; look for unexpected deployment of JSP, WAR, or executable files in non-standard paths. No reliable network-level indicator is derivable from the published description.","tags":["path-traversal","rce","upload","authenticated","ibm","api-connect"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:52:34.849Z"}}