{"id":"CVE-2025-13491","aliases":["EUVD-2025-206870","GHSA-f4xv-648j-g6xj"],"status":"published","title":"IBM App Connect Enterprise Certified Container Information Disclosure","description":"IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00164,"percentile":0.0566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-426"],"published":"2026-02-05T13:55:21Z","modified":"2026-06-17T08:34:14Z","products":[{"vendor":"ibm","product":"app connect enterprise certified container"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7259746","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13491"},{"url":"https://github.com/advisories/GHSA-f4xv-648j-g6xj"}],"sources":{"cve":[{"id":"CVE-2025-13491","title":"IBM App Connect Enterprise Certified Container Information Disclosure","description":"IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.","status":"published","published":"2026-02-05T13:55:21.838Z","modified":"2026-03-13T23:16:33.682Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:32:43.10004Z"}],"euvd":[{"id":"EUVD-2025-206870","description":"IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.","status":"published","published":"2026-02-05T13:55:21Z","modified":"2026-03-13T23:16:33Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:35.010093Z"}],"ghsa":[{"id":"GHSA-f4xv-648j-g6xj","title":"IBM App Connect Enterprise Certified Container up to 12.19.0 (Continuous Delivery) and 12.0 LTS ...","description":"IBM App Connect Enterprise Certified Container up to 12.19.0 (Continuous Delivery) and 12.0 LTS (Long Term Support) could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.","status":"published","published":"2026-02-05T15:31:14Z","modified":"2026-02-05T15:31:15Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:06:03.410025Z"}],"nvd":[{"id":"CVE-2025-13491","description":"IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.","status":"published","published":"2026-02-05T14:16:03.94Z","modified":"2026-06-17T08:34:14.48Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:11:59.832225Z"}]}}