External file path control enabling remote code execution in IBM Documentation Offline (CVE-2026-17482)

IBM Documentation Offline contains a vulnerability in its embedded Node.js server's template engine whereby external control of a file path (CWE-73) allows a remote, unauthenticated attacker to execute arbitrary code within the privilege context of the desktop application. The vulnerability is network-reachable with no user interaction required, carrying a CVSS 3.1 base score of 9.8. Affected versions: - IBM Documentation Offline 1.0.0 - 1.4.1 We recommend updating to: 1.5.1. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7283484 Details: https://vuln.today/cve/CVE-2026-17482