CVE-2026-12660

LowCVSS 2.7/10Last modified Oct 23, 2026

Description

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
IBMMQ Operator>= 3.2.0, <= 3.2.29; >= 3.3.0, < 3.4.0; 3.4.1; 3.5.0; >= 3.5.1, <= 3.5.3; >= 3.6.0, <= 3.6.4; >= 3.7.0, <= 3.7.2; 3.8.0; 3.8.1; 3.9.0; 3.9.1; 3.9.2; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; >= 2.0.0, <= 2.0.29
IBMMQ Advanced container images>= 9.4.0.6-r1, <= r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2; 9.4.0.6-r2; 9.4.0.7-r1; 9.4.0.10-r1; 9.4.0.10-r2; 9.4.0.11-r1; 9.4.0.11-r2; 9.4.0.11-r3; 9.4.0.12-r1; >= 9.4.0.15-r1, <= 9.4.0.15-r4; 9.4.0.16-r1; 9.4.0.16-r2; 9.4.0.17-r1; 9.4.0.17-r2; 9.4.0.20-r1; 9.4.0.21-r1; 9.4.0.21-r2; >= 9.4.0.25-r1, <= 9.4.0.25-r3; 9.4.0.26-r1; 9.4.1.0-r1

References

Timeline

Published
Oct 19, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1266077.8Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the foCVE-2026-1266097.5Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or veCVE-2026-126614.8A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition.  A network adjacent attacker who is authenticated cCVE-2026-1266107.4Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database clieCVE-2026-1266117.0Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify tCVE-2026-1266127.8Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to CVE-2026-1266137.5Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to eCVE-2026-1266145.3The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it aCVE-2026-1266155.3The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which tCVE-2026-1266165.3The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address aftCVE-2026-1266178.8SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSCVE-2026-1266185.3The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which