CVE-2026-17482
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
Risk Assessment
The risk includes remote code execution on the server, potentially leading to full system and data compromise.
Recommendation
It is recommended to update IBM Documentation Offline to a patched version and implement strict file path validation.
Other vulnerabilities in IBM Documentation Offline
See all- CVE-2026-17481High
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
- CVE-2026-17473High
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
- CVE-2026-17468Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.
- CVE-2026-16713Medium
IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.
Original NVD description (English source)
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS