Remote Code Execution in IBM Documentation Offline

IBM Documentation Offline versions 1.0.0 through 1.4.1 contain a critical security vulnerability, tracked as CVE-2026-17482. The vulnerability arises from improper control of file paths, classified under CWE-73 (External Control of File Name or Path). This flaw allows a remote, unauthenticated attacker to manipulate file paths to achieve arbitrary code execution on the underlying host system. Given the CVSS v3.1 score of 9.8, this vulnerability poses a significant risk to organizations deploying this software, as it does not require user interaction or elevated privileges for successful exploitation. IBM has documented this flaw and users are advised to review the official support documentation for remediation steps.

Attack Chain

1. The attacker identifies an instance of IBM Documentation Offline exposed to the network.
2. The attacker crafts a malicious request containing manipulated file paths targeting the application's file handling functionality.
3. The request is submitted to the application's web interface or relevant input vector without authentication.
4. The application processes the malicious input due to improper path validation.
5. The attacker successfully traverses outside intended directory boundaries to write or execute an arbitrary file on the system.
6. The system executes the attacker-controlled code, leading to full system compromise.

Impact

Successful exploitation of CVE-2026-17482 grants an attacker the ability to execute arbitrary code with the privileges of the application process. This can lead to complete system compromise, unauthorized access to sensitive data, and potential lateral movement within the environment. Given the nature of the application as documentation software, it may be deployed in various corporate environments, increasing the potential attack surface.

Recommendation

• Review all deployments of IBM Documentation Offline to identify systems running versions 1.0.0 through 1.4.1.
• Consult the official IBM security advisory (https://www.ibm.com/support/pages/node/7283484) to determine available patches or mitigation configurations.
• Restrict network access to IBM Documentation Offline instances to authorized personnel only, specifically limiting exposure from the public internet.