IBM MQ Path Traversal
Summary
| CVE | CVE-2026-12660 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-19 17:17:18 UTC |
| Updated | 2026-10-20 17:17:38 UTC |
| Description | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. |
Risk And Classification
Primary CVSS: v3.1 2.7 LOW from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.002400000 probability, percentile 0.141510000 (date 2026-10-20)
Problem Types: CWE-22 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 2.7 | LOW | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| 3.1 | CNA | CVSS | 2.7 | LOW | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | MQ Operator | affected 3.2.0 3.2.29 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.3.0 3.4.0 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.4.1 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.5.0 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.5.1 3.5.3 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.6.0 3.6.4 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.7.0 3.7.2 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.8.0 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.8.1 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.9.0 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.9.1 semver | Not specified |
| CNA | IBM | MQ Operator | affected 3.9.2 semver | Not specified |
| CNA | IBM | MQ Operator | affected 4.0.0 semver | Not specified |
| CNA | IBM | MQ Operator | affected 4.0.1 semver | Not specified |
| CNA | IBM | MQ Operator | affected 4.0.2 semver | Not specified |
| CNA | IBM | MQ Operator | affected 4.0.3 semver | Not specified |
| CNA | IBM | MQ Operator | affected 4.0.4 semver | Not specified |
| CNA | IBM | MQ Operator | affected 2.0.0 2.0.29 semver | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.6-r1 r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 semver | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.6-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.7-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.10-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.10-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.11-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.11-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.11-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.12-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.15-r1 9.4.0.15-r4 custom | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.16-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.16-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.17-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.17-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.20-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.21-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.21-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.25-r1 9.4.0.25-r3 custom | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.26-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.1.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.1.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.1.1-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.2.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.2.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.2.1-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.2.1-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.3.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.3.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.3.1-r1 9.4.3.1-r3 custom | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.4.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.4.1-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.5.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.5.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.5.1-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 10.0.0.0-r1 10.0.0.0-r4 custom | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 10.0.0.5-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.0-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.1-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.1-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.1-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.1-r4 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.3-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.4-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.4-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.5-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.5-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.5-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.6-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.10-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.10-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.11-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.11-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.15-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.16-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.16-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.17-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.17-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.17-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.20-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.20-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.21-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.21-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.21-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.3.0.25-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.0-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.0-r2 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.0-r3 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.5-r1 | Not specified |
| CNA | IBM | MQ Advanced Container Images | affected 9.4.0.5-r2 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7292667 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Issues mentioned by this security bulletin are addressed in - * IBM MQ Operator v4.1.0 https://www.ibm.com/docs/en/ibm-mq/10.0.x CD release that included IBM supplied MQ Advanced 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. * IBM MQ Operator v4.0.5 https://www.ibm.com/docs/en/ibm-mq/10.0.x SC2 release that included IBM supplied MQ Advanced 10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. * IBM MQ Operator v3.2.30 https://www.ibm.com/docs/en/ibm-mq/9.4.x SC2 release that included IBM supplied MQ Advanced 9.4.0.26-r2 https://www.ibm.com/docs/en/ibm-mq/9.4.x container image. * IBM MQ Container 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x and 10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x release. IBM strongly recommends applying the latest container images. IBM MQ Operator v4.1.0 CD release details: Image Fix Version Registry Image Location ibm-mq-operator v4.1.0 icr.io icr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127 ibm-mqadvanced-server 10.0.1.0-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3 ibm-mqadvanced-server-dev 10.0.1.0-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2 IBM MQ Operator v4.0.5 SC2 release details: Image Fix Version Registry Image Location ibm-mq-operator v4.0.5 icr.io icr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930 ibm-mqadvanced-server 10.0.0.5-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652 ibm-mqadvanced-server-dev 10.0.0.5-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b IBM MQ Operator v3.2.30 SC2 release details: Image Fix Version Registry Image Location ibm-mq-operator v3.2.30 icr.io icr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40 ibm-mqadvanced-server 9.4.0.26-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8 ibm-mqadvanced-server-integration 9.4.0.26-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad ibm-mqadvanced-server-dev 9.4.0.26-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a IBM MQ Container 10.0.1.0-r1 release details: Image Fix Version Registry Image Location ibm-mqadvanced-server 10.0.1.0-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3 ibm-mqadvanced-server-dev 10.0.1.0-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2 IBM MQ Container 10.0.0.5-r2 release details: Image Fix Version Registry Image Location ibm-mqadvanced-server 10.0.0.5-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652 ibm-mqadvanced-server-dev 10.0.0.5-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b