IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller are affected by a path-segment injection vulnerability in the collective routing mechanism. This vulnerability is identified as CWE-22, which relates to improper path handling. The vulnerability has a high severity rating and a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact.