CVE-2026-17473 PUBLISHED

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Assigner: ibm
Reserved: 25.07.2026 Published: 13.08.2026 Updated: 13.08.2026

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Documentation Offline
Versions	affected from 1.0.0 to 1.4.1 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Documentation Offline1.0.0 - 1.4.1Download and install latest release (1.5.1)

References

https://www.ibm.com/support/pages/node/7283484

Problem Types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE