IBM Documentation Offline Vulnerability Advisory: RCE, Info Leak, Session Forgery (CVE-2026-XXXX)

IBM Documentation Offline Security Vulnerability Summary Vulnerability Overview IBM Documentation Offline is a desktop application that includes an Electron-based viewer and an embedded Node.js web server to provide product documentation locally on user workstations. The application contains multiple security vulnerabilities involving information disclosure, session forgery, and remote code execution. Detailed Vulnerability Information 1. CVE-2026-17482 - Description: IBM Documentation allows remote attackers to execute arbitrary code due to improper control of file path components. - CVSS Base Score: 9.8 2. CVE-2026-16713 - Description: IBM Documentation allows remote attackers to obtain sensitive information due to insecure configuration (the documentation server binds to an unrestricted IP address). - CVSS Base Score: 4.3 3. CVE-2026-17468 - Description: IBM Documentation allows remote attackers to forge valid session tokens due to the use of a hardcoded encryption key. - CVSS Base Score: 5.3 4. CVE-2026-17481 - Description: IBM Documentation allows remote attackers to execute arbitrary code due to insufficient neutralization of data within log outputs. - CVSS Base Score: 8.8 5. CVE-2026-17473 - Description: IBM Documentation allows remote attackers to read arbitrary files due to improper restriction of path names for restricted directories. - CVSS Base Score: 7.5 Scope of Impact Affected Product: IBM Documentation Offline Affected Versions: 1.0.0 - 1.4.1 Operating Systems: Windows, Linux, Mac OS Remediation IBM strongly recommends resolving these vulnerabilities immediately. Remediation Steps Product: IBM Documentation Offline Versions: 1.0.0 - 1.4.1 Remediation: Download and install the latest version (1.5.1) Additional Information Release Date: August 13, 2026 Document ID: 7283494 References: - Complete CVSS v3 Guide - Online Calculator v3 Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry standard designed by the Forum of Incident Response and Security Teams (FIRST) to convey vulnerability severity and to determine the urgency and priority of response. IBM provides the CVSS scores "AS IS" without any warranty, either expressed or implied. It is the customer’s responsibility to evaluate the impact of any actual or potential security vulnerability. IBM periodically updates the component records contained in the product/service inventory and addresses related vulnerabilities regardless of their CVE date. The citation of an older CVEID does not indicate that the cited product has been used by IBM since that date, nor that IBM was aware of the vulnerability at the time of its disclosure. We are working to make customers aware of relevant vulnerabilities as we become more aware. IBM security bulletins referencing "Affected Products and Versions" are intended to list only products and versions supported by IBM and not past their end of support or warranty dates. Therefore, the absence of an IBM security bulletin referencing unsupported or extended support products and versions does not constitute an obligation for IBM to provide fixes for unsupported versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Documentation Offline Vulnerability Advisory: RCE, Info Leak, Session Forgery (CVE-2026-XXXX)

More from this source