CVE-2026-12660: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM MQ Operator

IBM MQ Web Console contains a path traversal vulnerability (CWE-22) where an authenticated administrator can write files outside the intended directory because of improper limitation of a pathname to a restricted directory. This improper path validation flaw could allow modification of files beyond the designated directory scope. The vulnerability affects numerous versions of IBM MQ Operator as explicitly listed. The CVSS 3.1 base score is 2.7, reflecting low severity with impact limited to integrity (I:L) and requiring high privileges (PR:H). No vendor advisory or patch information is provided in the input data.

The vulnerability allows an authenticated administrator to write files outside the intended directory, potentially modifying files that should be protected. There is no impact on confidentiality or availability. The low CVSS score (2.7) and requirement for high privileges indicate limited risk if proper administrative controls are maintained. No known active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unauthorized file modifications within the system. No vendor advisory or official fix information is provided in the input data.