IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that allows a remote authenticated attacker to execute arbitrary code. The issue arises because file paths in uploaded content are not properly validated, enabling files to be written outside intended directories and potentially leading to code execution.