EUVD-2026-58459
GHSA-fvvq-gc75-jg22
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes network-reachable unauthenticated RCE via path control with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C/I/A high; scope unchanged absent evidence of cross-system impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
AnalysisAI
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusing improper control of file paths (CWE-73). The flaw is reachable over the network without authentication or user interaction per the vendor-assigned CVSS 9.8 vector, giving an attacker full read/write/execution impact on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is network reachability of the IBM Documentation Offline service running an affected version (1.0.0-1.4.1); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication or user-interaction requirement, indicating remote unauthenticated exploitation against reachable instances. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a worst-case, network-reachable, unauthenticated RCE with low attack complexity, which on its face warrants urgent prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Documentation Offline service over the network sends a crafted request containing a manipulated file path that the application fails to validate, causing a file to be written or executed outside its intended directory and resulting in arbitrary code execution on the host. Because the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) with low complexity, this can be attempted directly against an exposed instance. … |
| Remediation | Patch available per vendor advisory: upgrade IBM Documentation Offline to the fixed release identified in IBM's security bulletin at https://www.ibm.com/support/pages/node/7283484 (an exact fixed version number is not included in the available data and should be confirmed from that advisory before deployment). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Documentation Offline 1.0.0 through 1.4.1 and isolate or restrict network access until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output writ
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitra
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unaut
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today