Skip to content
OpenAdvisories
Low · 2.7 CVE-2026-12660 EUVD-2026-104466GHSA-h65q-98c2-q928

IBM MQ Path Traversal

Published Oct 19, 2026 · Updated Oct 20, 2026 · Assigned by ibm

Vendor: IBM Product: MQ Advanced container images Product: MQ Operator

Description

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

Affected products

VendorProductAffectedFixed
IBM MQ Operator 3.2.0 – ≤ 3.2.29, 3.3.0 – < 3.4.0, 3.4.1, 3.5.0, 3.5.1 – ≤ 3.5.3, 3.6.0 – ≤ 3.6.4, 3.7.0 – ≤ 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 2.0.0 – ≤ 2.0.29 3.4.0
IBM MQ Advanced container images 9.4.0.6-r1 – ≤ r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.… —

References