IBM Doc Offline 1.01.4.1 RCE via improper file path control
CVE-2026-17482 Published on August 13, 2026

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-17482 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

External Control of File Name or Path

The software allows user input to control or influence paths or file names that are used in filesystem operations.


Products Associated with CVE-2026-17482

Want to know whenever a new CVE is published for IBM Documentation Offline? stack.watch will email you.

IBM Documentation Offline
 

Affected Versions

IBM Documentation Offline: