CVE-2026-17473

CVE-2026-17473 is a path traversal vulnerability in IBM Documentation Offline allowing arbitrary file read. The CVSS 7.5 reflects genuine severity that the EPSS score of 0.00462 understates—documentation viewers occupy a security blind spot that attackers have learned to probe precisely because defenders dismiss them as boring. This vulnerability persisted across four minor versions (1.0.0 through 1.4.1), which tells you the development pipeline had no security review catching this pattern. Path traversal is a solved problem in most frameworks—canonical path checks, directory containment validation, and sandboxed execution are well-documented mitigations. The absence across four releases suggests organizational pressure treating documentation tooling as not worth security investment, not a skills gap. What makes this dangerous: documentation tools frequently run with elevated privileges, access internal network paths, and operate inside the security perimeter on brand trust. A developer building version 1.0.0 of a documentation viewer treats it as 'just displaying docs'—that assumption creates the exact conditions where this class of vulnerability persists unchecked. The arbitrary file read is devastating when chained with any foothold: credential theft, config exfiltration, lateral movement. Check your environment for IBM Documentation Offline instances. If running, verify the version and prioritize upgrading to 1.4.2 or later. The fix is almost certainly a canonicalization call or path containment check—one-liner remediation that wasn't added because no one was assigned to look. Beyond patching, recalibrate threat models for internal tooling with privileged access regardless of perceived business value. The vulnerability isn't in the path concatenation—it's in the organizational assumption that boring tools don't need security scrutiny. That assumption is where the next four CVEs in this class will come from.

Reviewed through automated stages and approved by a human before publication.