{"id":"CVE-2026-17335","kind":"vulnerability","aliases":["CVE-2026-17335"],"related":[],"title":"IBM API Connect: path traversal in uploads lets an authenticated user run code","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate file paths in uploaded content, so files can be written outside the intended directory. An authenticated remote attacker can use this to get code executed on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["versions-outside-range"],"how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`","fix":"- Upgrade to a release later than `12.1.1.2`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:46+00:00","updated_at":"2026-11-07T05:48:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a release later than `12.1.1.2`; the sources do not name the exact fixed version","reach":"network","title":"IBM API Connect: path traversal in uploads lets an authenticated user run code","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate file paths in uploaded content, so files can be written outside the intended directory. An authenticated remote attacker can use this to get code executed on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker writes files outside intended path and runs code","analyst_note":"Find IBM's security bulletin for CVE-2026-17335 to confirm the fixed version and which upload features are affected.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can upload content. The attacker needs a valid account on the platform. The sources do not say which upload features or configurations are required, so teams on those versions should treat themselves as exposed until they confirm otherwise.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4232,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17335':16A,19A '-2026':15A,18A '12.1.0.0':35B,72C '12.1.1.2':37B,74C 'allow':76C,100C 'api':2A,21B,25B,32B,70C 'api-gateway':20B 'arbitrari':83C 'attack':58B,80C 'authent':10A,56B,79C 'code':13A,64B,84C,110C 'connect':3A,26B,33B,71C 'content':45B,93C 'could':75C,99C 'cve':14A,17A 'directori':54B 'due':85C 'execut':65B,82C,113C 'file':41B,47B,89C,101C 'gateway':22B 'get':63B 'host':29B 'ibm':1A,24B,31B,69C 'ibm-api-connect':23B 'intend':53B,107C 'let':8A 'locat':108C 'outsid':51B,105C 'path':4A,42B,87C,90C 'remot':57B,78C 'run':12A 'self':28B 'self-host':27B 'server':68B 'suffici':96C 'travers':5A,88C 'upload':7A,44B,92C 'use':60B 'user':11A 'valid':40B,97C 'vendor':30B 'version':34B 'written':50B,104C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can upload content. The attacker needs a valid account on the platform. The sources do not say which upload features or configurations are required, so teams on those versions should treat themselves as exposed until they confirm otherwise.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17335':16A,19A '-2026':15A,18A 'api':2A 'authent':10A 'code':13A 'connect':3A 'cve':14A,17A 'ibm':1A 'let':8A 'path':4A 'run':12A 'travers':5A 'upload':7A 'user':11A","search_b":"'12.1.0.0':35B '12.1.1.2':37B 'api':21B,25B,32B 'api-gateway':20B 'attack':58B 'authent':56B 'code':64B 'connect':26B,33B 'content':45B 'directori':54B 'execut':65B 'file':41B,47B 'gateway':22B 'get':63B 'host':29B 'ibm':24B,31B 'ibm-api-connect':23B 'intend':53B 'outsid':51B 'path':42B 'remot':57B 'self':28B 'self-host':27B 'server':68B 'upload':44B 'use':60B 'valid':40B 'vendor':30B 'version':34B 'written':50B","search_c":"'12.1.0.0':72C '12.1.1.2':74C 'allow':76C,100C 'api':70C 'arbitrari':83C 'attack':80C 'authent':79C 'code':84C,110C 'connect':71C 'content':93C 'could':75C,99C 'due':85C 'execut':82C,113C 'file':89C,101C 'ibm':69C 'intend':107C 'locat':108C 'outsid':105C 'path':87C,90C 'remot':78C 'suffici':96C 'travers':88C 'upload':92C 'valid':97C 'written':104C","first_public_at":"2026-11-07T05:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17335","severity":null,"published_at":"2026-11-07T05:18:44+00:00","modified_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}