CVE-2026-17437 PUBLISHED

IBM App Connect Enterprise is vulnerable to an arbitrary file write

Assigner: ibm
Reserved: 25.07.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS Score: 5.5

Product Status

Vendor IBM
Product App Connect Enterprise
Versions
  • affected from 13.0.1.0 to 13.0.8.2 (incl.)
  • affected from 12.0.1.0 to 12.0.12.29 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise

Affected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.2IT50104

The APAR (IT50104) is available from

IBM App Connect Enterprise v13- Fix Pack Release 13.0.9.0 https://www.ibm.com/support/pages/download-ibm-app-connect-enterprise-13090

IBM App Connect Enterprise12.0.1.0 - 12.0.12.29IT50104

The APAR (IT50104) is available from

IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.30 https://www.ibm.com/support/pages/download-ibm-app-connect-enterprise-1201230-fix-pack

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE