A critical path traversal vulnerability in IBM App Connect Enterprise allows unauthenticated remote attackers to achieve arbitrary file write, posing a severe risk to system integrity.

The software fails to properly sanitize input containing directory traversal sequences (dot dot slash). This allows an unauthenticated attacker to escape restricted directories and write files to arbitrary locations on the host system.

The ability to write arbitrary files can lead to full system compromise, including the installation of web shells or the overwriting of critical configuration files. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows remote code execution and total system takeover without requiring any user interaction or authentication.

Immediate Action: Upgrade to IBM App Connect Enterprise version 13.0.8.0 or apply the relevant fix provided in APAR IT49737.

Proactive Monitoring: Review application and system access logs for anomalous URL patterns containing traversal sequences such as dot dot slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal sequences to mitigate risk until patching is complete.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk to the confidentiality, integrity, and availability of affected systems. Administrators should prioritize the application of the vendor-supplied fix immediately to eliminate the threat of remote file system manipulation.