{"id":"CVE-2026-16719","kind":"vulnerability","aliases":["CVE-2026-16719"],"related":[],"title":"IBM API Connect: path traversal lets remote attackers read arbitrary files","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw triggered by a specially crafted URL request. A remote attacker can read files outside the intended directories on the server.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check whether your IBM API Connect version falls within `10.0.8.0` to `10.0.8.12` or `12.1.0.0` to `12.1.1.2`","fix":null,"status":"open","published_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:52:31+00:00","updated_at":"2026-11-07T05:52:31+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:52:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: path traversal lets remote attackers read arbitrary files","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw triggered by a specially crafted URL request. A remote attacker can read files outside the intended directories on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads arbitrary files on the server","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed versions and any required setting; the NVD entry alone does not state a fix.","how_to_check":"- Check whether your IBM API Connect version falls within `10.0.8.0` to `10.0.8.12` or `12.1.0.0` to `12.1.1.2`\n- unknown for other checks, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges are exposed to remote file reads through crafted URL requests. The sources do not describe further configuration conditions or which deployment modes are affected. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4251,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16719':14A,17A '-2026':13A,16A '10.0.8.0':30B,65C '10.0.8.12':32B,67C '12.1.0.0':34B,69C '12.1.1.2':36B,71C 'access':104C 'allow':73C,96C 'api':2A,20B,27B,63C 'arbitrari':10A,79C 'attack':8A,51B,76C 'connect':3A,21B,28B,64C 'contain':37B 'could':72C,95C 'craft':46B,92C 'cve':12A,15A 'directori':58B,97C 'due':84C 'file':11A,54B,80C 'flaw':41B 'host':24B 'ibm':1A,19B,26B,62C 'ibm-api-connect':18B 'intend':57B,100C 'let':6A 'locat':101C 'outsid':55B,98C 'path':4A,39B,87C 'read':9A,53B 'remot':7A,50B,75C 'request':48B,94C 'self':23B 'self-host':22B 'server':61B 'special':45B,91C 'system':83C 'travers':5A,40B,88C 'trigger':42B 'url':47B,93C 'vendor':25B 'version':29B 'view':78C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect in the affected version ranges are exposed to remote file reads through crafted URL requests. The sources do not describe further configuration conditions or which deployment modes are affected. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmapiconnect","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-16719':14A,17A '-2026':13A,16A 'api':2A 'arbitrari':10A 'attack':8A 'connect':3A 'cve':12A,15A 'file':11A 'ibm':1A 'let':6A 'path':4A 'read':9A 'remot':7A 'travers':5A","search_b":"'10.0.8.0':30B '10.0.8.12':32B '12.1.0.0':34B '12.1.1.2':36B 'api':20B,27B 'attack':51B 'connect':21B,28B 'contain':37B 'craft':46B 'directori':58B 'file':54B 'flaw':41B 'host':24B 'ibm':19B,26B 'ibm-api-connect':18B 'intend':57B 'outsid':55B 'path':39B 'read':53B 'remot':50B 'request':48B 'self':23B 'self-host':22B 'server':61B 'special':45B 'travers':40B 'trigger':42B 'url':47B 'vendor':25B 'version':29B","search_c":"'10.0.8.0':65C '10.0.8.12':67C '12.1.0.0':69C '12.1.1.2':71C 'access':104C 'allow':73C,96C 'api':63C 'arbitrari':79C 'attack':76C 'connect':64C 'could':72C,95C 'craft':92C 'directori':97C 'due':84C 'file':80C 'ibm':62C 'intend':100C 'locat':101C 'outsid':98C 'path':87C 'remot':75C 'request':94C 'special':91C 'system':83C 'travers':88C 'url':93C 'view':78C 'vulner':89C","first_public_at":"2026-11-07T05:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16719","severity":null,"published_at":"2026-11-07T05:18:21+00:00","modified_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}