High · 7.5 CVE-2026-17473 EUVD-2026-58456GHSA-9ff3-3px5-257x

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Published Aug 13, 2026 · Updated Aug 14, 2026 · Assigned by ibm

Vendor: IBM Product: Documentation Offline

Description

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.

Affected products

Vendor	Product	Affected	Fixed
IBM	Documentation Offline	1.0.0 – ≤ 1.4.1	—

References

https://www.ibm.com/support/pages/node/7283484 vendor-advisory patch