2.7
Low
CVE-2026-12660 IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to…
Description
IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MQ Operator 4.0 | 4.0.0 → 4.0.4 | No fix stated |
| MQ Operator 3.9 | 3.9.0 → 3.9.2 | No fix stated |
| MQ Operator 3.8 | 3.8.0 → 3.8.1 | No fix stated |
| MQ Operator 3.7 | 3.7.0 → 3.7.2 | No fix stated |
| MQ Operator 3.6 | 3.6.0 → 3.6.4 | No fix stated |
| MQ Operator 3.5 | 3.5.0 → 3.5.3 | No fix stated |
| MQ Operator | 3.4.1 | No fix stated |
| MQ Operator 3.3 | 3.3.0 → < 3.4.0 | 3.4.0 |
| MQ Operator 3.2 | 3.2.0 → 3.2.29 | No fix stated |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| MQ Operator 2.0 | 2.0.0 → 2.0.29 | No fix stated |
| MQ Advanced container images 10.0 | 10.0.0.0-r1 → 10.0.0.5-r1 | No fix stated |
| MQ Advanced container images 9.4 | 9.4.0.0-r1 → latest | No fix stated |
| MQ Advanced container images 9.3 | 9.3.0.0-r1 → 9.3.0.25-r1 | No fix stated |
Other CVEs of MQ Operator
The 27 CVEs of MQ Operator →
CVE-2026-10572
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a…
8.8
High
CVE-2026-10574
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a…
8.8
High
CVE-2026-10743
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation…
8.8
High
CVE-2026-11828
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to…
5.9
Medium