EUVD-2026-58458
GHSA-52mc-rhgp-6j85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated per vendor, but CWE-117-to-RCE requires an undocumented secondary log sink, so AC:H; total impact retained as C/I/A:H.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.
AnalysisAI
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Technical ContextAI
IBM Documentation Offline is a packaged distribution of IBM product documentation intended to be hosted and browsed without internet connectivity. The assigned weakness is CWE-117 (Improper Output Neutralization for Logs, i.e. log injection), which occurs when attacker-controlled input is written into log files or a log stream without sanitizing control characters or markup. On its own, CWE-117 typically enables log forging, log-viewer poisoning, or downstream injection; the escalation to arbitrary code execution implied by the RCE tag would require a secondary sink - for example a log consumer, template engine, or log-processing framework that evaluates the injected content. The single CPE cpe:2.3:a:ibm:documentation_offline:* confirms the affected component is the application itself across the 1.0.0-1.4.1 range; no library or third-party dependency is named in the supplied data.
RemediationAI
Patch available per vendor advisory: apply the fix referenced in IBM support document https://www.ibm.com/support/pages/node/7283484, which is the primary and recommended remediation - consult that page for the exact fixed build, as the specific patched version number is not included in the supplied intelligence and should not be guessed. Until the update is applied, reduce exposure by restricting network reachability of the Documentation Offline instance to trusted internal users (place it behind authentication or a reverse proxy / firewall ACL rather than exposing it publicly), and monitor and sanitize inputs that flow into its logs; the trade-off is that access restrictions may inconvenience legitimate offline-documentation consumers but meaningfully shrink the unauthenticated remote attack surface. Confirm the exact fixed version and any configuration steps directly from the IBM advisory before closing the ticket.
More in Documentation Offline
View allRemote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 allows an attacker to run arbitrary code by abusi
Path traversal in IBM Documentation Offline 1.0.0 through 1.4.1 enables unauthenticated remote attackers to read arbitra
Session token forgery is possible in IBM Documentation Offline versions 1.0.0 through 1.4.1 because the application uses
Information disclosure in IBM Documentation Offline 1.0.0 through 1.4.1 exposes sensitive documentation content to unaut
Same weakness CWE-117 – Improper Output Neutralization for Logs
View allShare
External POC / Exploit Code
Leaving vuln.today