CVE-2026-14973

Received Received - Intake

IBM Aspera Desktop App Path Traversal Vulnerability

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-14973

EUVD

EUVD-2026-50032

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aspera_desktop_app	From 1.0.5 (inc) to 1.0.19 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

IBM Aspera Desktop App versions 1.0.5 through 1.0.19 have a vulnerability where files can be written outside the user's selected download destination. This could allow unauthorized file writes to other locations on the system.

Detection Guidance

This vulnerability allows files to be written outside the intended download destination. Detection may involve checking file system logs for unexpected writes, monitoring user download paths, and verifying IBM Aspera Desktop App versions. No specific commands are provided in the given context.

Impact Analysis

This vulnerability could allow attackers to write malicious files to sensitive system locations, potentially leading to code execution, data theft, or system compromise. Users may unknowingly execute harmful files placed outside intended directories.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance violations if sensitive data is exposed or improperly accessed.

Mitigation Strategies

Update IBM Aspera Desktop App to the latest version beyond 1.0.19 to address the file writing vulnerability. Restrict user permissions to prevent unauthorized file operations outside designated download directories.

Hi! I’m here to help you understand CVE-2026-14973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70