A path traversal vulnerability (CVE-2026-15435) has been identified in IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27. The vulnerability allows a remote attacker to traverse directories on the affected system by sending specially crafted URL requests containing dot-dot sequences (/../). Successful exploitation enables an attacker to write arbitrary files anywhere on the system. This type of vulnerability can be leveraged for remote code execution, configuration tampering, or full system compromise. The vulnerability is remotely exploitable without requiring authentication details to be specified in the advisory. IBM has published a support page with remediation guidance. The affected versions span across two major product lines, indicating a broad impact across IBM App Connect Enterprise deployments.