Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-2606

IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM webMethods API Gateway (on-prem)

  • 10.11 to ≤ 10.11_Fix32affected
  • 10.15 to ≤ 10.15_Fix27affected
  • 11.1 to ≤ 11.1_Fix7affected

References