Path traversal in IBM Aspera Desktop App (CVE-2026-14973)

IBM Aspera Desktop App contains a path traversal vulnerability that allows files to be written outside of the user's selected download destination. This flaw, classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), carries a CVSS base score of 9.3 and is exploitable remotely without privileges, posing a high risk of unauthorized file write to the host system. Affected versions: - 1.0.5 - 1.0.19 We recommend updating to: 1.1.0. CVSS 9.3 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7280939 Details: https://vuln.today/cve/CVE-2026-14973