---
id: "CVE-2026-17335"
page: "https://infrastack.ai/live/CVE-2026-17335"
kind: "vulnerability"
aliases: ["CVE-2026-17335"]
title: "IBM API Connect: path traversal in uploads lets an authenticated user run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["versions-outside-range"]
published_at: "2026-11-07T05:18:44+00:00"
first_seen_at: "2026-11-07T05:46:04+00:00"
updated_at: "2026-11-07T05:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17335", "first_seen_at": "2026-11-07T05:46:04+00:00"}]
exploit_sources: []
---

# IBM API Connect: path traversal in uploads lets an authenticated user run code

Link for people: https://infrastack.ai/live/CVE-2026-17335 (this .md is for agents)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate file paths in uploaded content, so files can be written outside the intended directory. An authenticated remote attacker can use this to get code executed on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`

## Fix

- Upgrade to a release later than `12.1.1.2`; the sources do not name the exact fixed version

## Timeline

- 2026-11-07T05:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17335

## From the sources

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_