CVE-2026-17473
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
Risk Assessment
The risk includes the possibility of unauthorized reading of sensitive files, which could lead to data leakage.
Recommendation
It is recommended to update IBM Documentation Offline to the latest version and implement file access controls.
Other vulnerabilities in IBM Documentation Offline
See all- CVE-2026-17482Critical
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
- CVE-2026-17481High
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
- CVE-2026-17468Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
- CVE-2026-16713Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.
Original NVD description (English source)
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS