CVE-2026-17481 PUBLISHED

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Assigner: ibm
Reserved: 25.07.2026 Published: 13.08.2026 Updated: 13.08.2026

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	IBM
Product	Documentation Offline
Versions	affected from 1.0.0 to 1.4.1 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Documentation Offline1.0.0 - 1.4.1Download and install latest release (1.5.1)

References

https://www.ibm.com/support/pages/node/7283484

Problem Types

CWE-117 Improper Output Neutralization for Logs CWE