CVE-2026-17473CWE-22path-traversal

CVE-2026-17473

High · published August 14, 2026

CVSS v3.1

7.5

EPSS

Percentile

49.2

In the wild

Unconfirmed

What it is

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00623 · 49.2th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-08-14T01:17Z

Affected products (1)

Product	Versions	Fixed in
ibm/documentation_offline	≥ 1.0.0, ≤ 1.4.1	—

References (1)

https://www.ibm.com/support/pages/node/7283484 · [email protected]

EPSS history

Timeline

13 AUG 20:37Z
IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
cvelistv5