CVE-2026-2606

Published: Mar 3, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: psirt@us.ibm.com (Secondary)

Description

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

Affected (6)

Products: Ibm: Webmethods Api Gateway

Ibm

1 product

Webmethods Api Gateway

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ibm Webmethods Api Gateway	Version 10.11
Ibm Webmethods Api Gateway	Version 10.11 fix32
Ibm Webmethods Api Gateway	Version 10.15
Ibm Webmethods Api Gateway	Version 10.15 fix27
Ibm Webmethods Api Gateway	Version 11.1
Ibm Webmethods Api Gateway	Version 11.1 fix7

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

https://www.ibm.com/support/pages/node/7261122

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.