CVE-2026-17481
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
Risk Assessment
The risk includes the possibility of remote arbitrary code execution, which could lead to full system compromise.
Recommendation
It is recommended to update IBM Documentation Offline to the latest version and restrict access to the application.
Other vulnerabilities in IBM Documentation Offline
See all- CVE-2026-17482Critical
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
- CVE-2026-17473High
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
- CVE-2026-17468Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
- CVE-2026-16713Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.
Original NVD description (English source)
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS