EUVD-2026-58456
GHSA-9ff3-3px5-257x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible service with no authentication gate per design; read-only file disclosure sets I and A to N; scope unchanged as impact is confined to the vulnerable application's filesystem access.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.
AnalysisAI
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector confirms fully network-accessible exploitation with no privileges or user interaction required, resulting in high confidentiality impact but no integrity or availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability to the IBM Documentation Offline service - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against any network-accessible instance running versions 1.0.0 through 1.4.1 in their default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is well-supported by the vector: the attack is fully unauthenticated (PR:N), requires no user interaction (UI:N), operates over the network at low complexity (AV:N/AC:L), and yields high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends an HTTP GET request to the IBM Documentation Offline server with a URL containing path traversal sequences, such as '/docs/../../../../etc/shadow' or an equivalent URL-encoded form. The server fails to restrict the resolved path to the documentation directory and returns the raw contents of the targeted file. … |
| Remediation | Apply the vendor-released patch per the IBM security advisory at https://www.ibm.com/support/pages/node/7283484. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of IBM Documentation Offline versions 1.0.0-1.4.1 currently deployed and assess network exposure, particularly any instances accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusi
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output writ
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unaut
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today