Path traversal in IBM App Connect Enterprise - CVE-2025-0799
Published: March 17, 2025
Vulnerability identifier: #VU105782
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0799
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
Affected software
IBM App Connect Enterprise
App Connect Enterprise Certified Container
App Connect Enterprise Certified Container
How to mitigate CVE-2025-0799
Install updates from vendor's website.
App Connect Enterprise Certified Container - addressed in versions 12.0.9, 12.9.0