CVE-2026-17335

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability (CWE-22) in file upload handling, allowing an authenticated attacker to write files outside the intended directory and potentially achieve remote code execution.

Exploitability

Exploitation requires valid authentication and the ability to upload content with manipulated file paths, but no UI interaction or complex conditions are needed beyond basic HTTP access.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts on the affected API Connect management plane.

Detection

Defenders should monitor for anomalous file creation outside expected upload directories (e.g., in parent or sibling folders of /opt/ibm/api-connect/upload) in application logs or filesystem audit trails; look for unexpected deployment of JSP, WAR, or executable files in non-standard paths. No reliable network-level indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for CVE-2026-17335.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.