What is the CVSS score of EUVD-2026-58456?

EUVD-2026-58456 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of IBM Documentation Offline are affected by EUVD-2026-58456?

IBM Documentation Offline versions 1.0.0 through 1.4.1 allow unauthenticated attackers to access and read arbitrary files from affected servers over the network.. A patch is available.

How to fix or mitigate EUVD-2026-58456?

Within 24 hours, identify all instances of IBM Documentation Offline versions 1.0.0-1.4.1 currently deployed and assess network exposure, particularly any instances accessible from untrusted networks. Within 7 days, apply the vendor-released patch to all affected systems, prioritizing internet-facing instances; for systems that cannot be patched immediately, implement network segmentation to restrict access to trusted hosts only. Within 30 days, verify patch deployment completion across all systems, review server access logs for signs of suspicious file access attempts, and confirm no unauthorized data disclosure occurred during the vulnerability window.

IBM Documentation Offline EUVD-2026-58456

| CVE-2026-17473 HIGH

Path Traversal (CWE-22)

2026-08-13 ibm

GHSA-9ff3-3px5-257x

Path Traversal IBM Documentation Offline

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible service with no authentication gate per design; read-only file disclosure sets I and A to N; scope unchanged as impact is confined to the vulnerable application's filesystem access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:42 vuln.today

CVE Published

Aug 13, 2026 - 20:37 nvd

HIGH 7.5

DescriptionCVE.org

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.

AnalysisAI

Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector confirms fully network-accessible exploitation with no privileges or user interaction required, resulting in high confidentiality impact but no integrity or availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the trivial attack complexity and zero-authentication requirement make exposed instances an immediate patching priority.

Technical ContextAI

IBM Documentation Offline is an application that serves product documentation content for offline use, likely over an embedded HTTP server. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: the application fails to canonicalize or sufficiently validate user-supplied path components, permitting directory traversal sequences such as '../' or URL-encoded equivalents to escape the intended document root directory and reference arbitrary filesystem paths. The CPE string cpe:2.3:a:ibm:documentation_offline:*:*:*:*:*:*:*:* confirms the IBM Documentation Offline application is the exclusive affected component across all versions from 1.0.0 through 1.4.1. Because the product exposes a network interface (AV:N), file read requests are reachable without local access, and the scope is unchanged (S:U), meaning the impact is confined to the process's accessible filesystem resources.

RemediationAI

Apply the vendor-released patch per the IBM security advisory at https://www.ibm.com/support/pages/node/7283484. Patch availability is confirmed by IBM, but the exact fixed version number is not specified in the available intelligence data and must be obtained directly from that advisory before targeting an upgrade. As a compensating control for systems that cannot be patched immediately, restrict network access to the IBM Documentation Offline service to trusted hosts or VPN-only segments using firewall ACLs - this directly addresses the AV:N attack vector and is the highest-impact interim mitigation. Additionally, deploying a WAF with rules to block path traversal patterns (../, ..%2F, ..%5C, and double-encoded variants) can reduce exposure, though WAF rules are bypassable through novel encoding and should not substitute for patching. Note that running the Documentation Offline process under a least-privilege account limits the files an attacker can read even if exploitation succeeds.