IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 contain a CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated remote attacker can exploit this by sending a crafted URL with "dot dot" sequences (/../) to traverse directories and write arbitrary files on the system. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows remote attackers to write arbitrary files anywhere on the system, potentially leading to full system compromise including data theft, data manipulation, or denial of service. The vulnerability affects confidentiality, integrity, and availability with critical severity (CVSS 9.8).

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected IBM App Connect Enterprise instances and monitor for suspicious URL requests containing directory traversal patterns. Avoid exposing the service directly to untrusted networks.