Path Traversal in IBM App Connect Enterprise Certified Container

Published: 2022-08-18
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2021-32803
Exploitation vector Network
Public exploit N/A
Vulnerable software
App Connect Enterprise Certified Container
Server applications / Other server solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Absolute Path Traversal

EUVDB-ID: #VU58206

Risk: Medium


CVE-ID: CVE-2021-32803

CWE-ID: CWE-36 - Absolute Path Traversal

Exploit availability: No


The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to a logic issue when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.


Install update from vendor's website.

Vulnerable software versions

App Connect Enterprise Certified Container: 1.0 - 2.0

CPE2.3 External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?