Description

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T21:17:43.067Z",
  "pubdate": "2026-08-13T21:17:43.067Z",
  "executiveSummary": "A path traversal vulnerability exists in IBM Documentation Offline versions 1.0.0 through 1.4.1. This security flaw allows a remote, unauthenticated attacker to read arbitrary files from the underlying operating system by improperly restricting pathnames to a designated restricted directory.\nThe vulnerability stems from insufficient input validation and sanitization of file retrieval requests processed by the application. An attacker can manipulate input parameters containing directory traversal sequences, such as dot-dot-slash (../) notations, to break out of the intended web root or document repository.\nSuccessful exploitation of this vulnerability compromises the confidentiality of the host system. The attacker can harvest sensitive configuration files, system data, or other restricted content accessible to the process context. The risk implications are severe for environments hosting the offline documentation suite, as unauthorized file access can facilitate further attacks or expose credentials.\nExploitation requires network access to the vulnerable service, but no prior authentication or elevated privileges are necessary. Remediation relies on applying vendor-supplied updates or implementing strict input filtering to neutralize directory traversal vectors.",
  "technicalDetails": "The root cause of the vulnerability is the improper limitation of a pathname to a restricted directory, commonly classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory or Path Traversal).\nThe vulnerable component resides within the file retrieval and serving mechanism of IBM Documentation Offline 1.0.0 through 1.4.1. When the application processes incoming requests for static assets or documentation pages, it fails to adequately sanitize the requested file paths.\nAn attacker initiates the attack flow by crafting a malicious HTTP request directed at the vulnerable service over the network. The request incorporates directory traversal sequences, such as sequences of '../' characters, into the file retrieval parameter. Because the application lacks robust canonicalization and validation checks, it resolves the supplied relative path outside the intended restricted directory.\nThe attack does not require authentication or specific privileges, meaning any remote user with network access to the application port can submit the maliciously crafted payload. Upon receiving the payload, the application accesses the file system using the privileges of the running process, reads the targeted arbitrary file, and includes the file contents in the HTTP response body.\nThe payload behavior involves traversing upward through the directory hierarchy to access sensitive system files or application configuration data residing outside the web root. The post-exploitation impact is strictly tied to a loss of confidentiality, allowing unauthorized retrieval of files that the service account has read access to. This may expose internal system information, sensitive environment variables, or credentials that can be leveraged in subsequent compromise stages."
}