CVE-2026-14973CWE-22path-traversal

CVE-2026-14973

Critical · published July 29, 2026

CVSS v3.1

9.3

EPSS

Percentile

38.3

In the wild

Unconfirmed

What it is

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

The record

Technical detail

CVSS v3.1: 9.3 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00452 · 38.3th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-07-29T01:17Z

Affected products (1)

Product	Versions	Fixed in
ibm/aspera	≥ 1.0.5, ≤ 1.0.19	—

References (1)

EPSS history

Timeline