{"id":"CVE-2026-17437","kind":"vulnerability","aliases":["CVE-2026-17437"],"related":[],"title":"IBM App Connect Enterprise: local user can write arbitrary files during archive extraction","description":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.","summary":"IBM App Connect Enterprise does not validate pathnames when it extracts archives, so a local attacker can write files to locations they should not reach. The sources give a CVSS score of 5.5 and do not describe exploitation in the wild.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-app-connect-enterprise","infrastructure","self-hosted"],"not_affected_if":["outside-affected-ranges"],"how_to_check":"- Check the installed IBM App Connect Enterprise version against the affected ranges: 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29.","fix":null,"status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:57+00:00","updated_at":"2026-11-08T18:22:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM App Connect Enterprise: local user can write arbitrary files during archive extraction","impact":"medium","summary":"IBM App Connect Enterprise does not validate pathnames when it extracts archives, so a local attacker can write files to locations they should not reach. The sources give a CVSS score of 5.5 and do not describe exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-app-connect-enterprise","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker writes arbitrary files on the host","analyst_note":"Confirm the fixed versions and any archive-extraction setting on the IBM security bulletin for CVE-2026-17437.","how_to_check":"- Check the installed IBM App Connect Enterprise version against the affected ranges: 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29.\n- unknown for other checks; the sources do not say which configuration or archive feature is involved.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-ranges"],"who_is_affected":"Organisations running IBM App Connect Enterprise in the affected version ranges are exposed, and the attacker must already have local access to the machine. Teams running other versions, or without local user access on the host, can skip it. The sources do not say which archive extraction path is involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4564,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17437':16A,19A '-2026':15A,18A '12.0.1.0':78C '12.0.12.29':80C '13.0.1.0':74C '13.0.8.2':76C '5.5':61B 'allow':82C 'app':2A,22B,30B,71C 'arbitrari':9A,89C 'archiv':12A,40B,99C 'attack':44B,85C 'connect':3A,23B,31B,72C 'could':81C 'cve':14A,17A 'cvss':58B 'describ':65B 'due':92C 'enterpris':4A,24B,32B,73C 'exploit':66B 'extract':13A,39B,100C 'file':10A,47B,90C 'give':56B 'host':28B 'ibm':1A,21B,29B,70C 'ibm-app-connect-enterpris':20B 'improp':94C 'infrastructur':25B 'local':5A,43B,84C 'locat':49B 'pathnam':36B,97C 'perform':87C 'reach':53B 'score':59B 'self':27B 'self-host':26B 'sourc':55B 'user':6A 'valid':35B,95C 'wild':69B 'write':8A,46B,91C","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM App Connect Enterprise in the affected version ranges are exposed, and the attacker must already have local access to the machine. Teams running other versions, or without local user access on the host, can skip it. The sources do not say which archive extraction path is involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmappconnectenterprise","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-17437':16A,19A '-2026':15A,18A 'app':2A 'arbitrari':9A 'archiv':12A 'connect':3A 'cve':14A,17A 'enterpris':4A 'extract':13A 'file':10A 'ibm':1A 'local':5A 'user':6A 'write':8A","search_b":"'5.5':61B 'app':22B,30B 'archiv':40B 'attack':44B 'connect':23B,31B 'cvss':58B 'describ':65B 'enterpris':24B,32B 'exploit':66B 'extract':39B 'file':47B 'give':56B 'host':28B 'ibm':21B,29B 'ibm-app-connect-enterpris':20B 'infrastructur':25B 'local':43B 'locat':49B 'pathnam':36B 'reach':53B 'score':59B 'self':27B 'self-host':26B 'sourc':55B 'valid':35B 'wild':69B 'write':46B","search_c":"'12.0.1.0':78C '12.0.12.29':80C '13.0.1.0':74C '13.0.8.2':76C 'allow':82C 'app':71C 'arbitrari':89C 'archiv':99C 'attack':85C 'connect':72C 'could':81C 'due':92C 'enterpris':73C 'extract':100C 'file':90C 'ibm':70C 'improp':94C 'local':84C 'pathnam':97C 'perform':87C 'valid':95C 'write':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17437","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}