---
id: "CVE-2026-17437"
page: "https://infrastack.ai/live/CVE-2026-17437"
kind: "vulnerability"
aliases: ["CVE-2026-17437"]
title: "IBM App Connect Enterprise: local user can write arbitrary files during archive extraction"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-app-connect-enterprise", "infrastructure", "self-hosted"]
not_affected_if: ["outside-affected-ranges"]
published_at: "2026-11-08T18:17:03+00:00"
first_seen_at: "2026-11-08T18:22:22+00:00"
updated_at: "2026-11-08T18:22:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17437", "first_seen_at": "2026-11-08T18:22:22+00:00"}]
exploit_sources: []
---

# IBM App Connect Enterprise: local user can write arbitrary files during archive extraction

Link for people: https://infrastack.ai/live/CVE-2026-17437 (this .md is for agents)

IBM App Connect Enterprise does not validate pathnames when it extracts archives, so a local attacker can write files to locations they should not reach. The sources give a CVSS score of 5.5 and do not describe exploitation in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM App Connect Enterprise version against the affected ranges: 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29.

## Timeline

- 2026-11-08T18:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17437

## From the sources

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_