Security Bulletin: IBM ContextForge MCP Gateway is affected by path traversal

Summary IBM ContextForge MCP Gateway Admin API contains a path traversal vulnerability in the administrative log download handler /v1/admin/logs/file where an authenticated user with administrative privileges can retrieve files from sibling directories sharing a common path prefix with the log...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...