IBM disclosed a critical path traversal flaw in the IBM Aspera Desktop App that lets transferred files land outside the download folder the user actually chose.
What Is It
CVE-2026-14973 is a path traversal weakness (CWE-22) in IBM Aspera Desktop App. Per IBM's advisory, the application "can allow files to be written outside of the user's selected download destination." IBM PSIRT rates it CVSS 3.1 base score 9.3 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
The vector breaks down to: network-reachable, low attack complexity, no privileges needed, but user interaction required; the victim has to initiate or accept a transfer. Scope is Changed, which is what pushes the score into the 9s: writing outside the intended directory escapes the app's own security boundary and affects the wider host. Confidentiality and integrity impact are both High; availability impact is None.
Why It Matters
Arbitrary file write outside a user-selected download directory is a classic foothold. Files placed into startup paths, configuration directories, or locations that other software trusts convert a file transfer into control over the endpoint. The Scope:Changed rating reflects exactly that; the damage is not contained to the Aspera app.
Aspera is widely deployed for large-file transfer in media, research, and enterprise workflows, so the desktop client tends to sit on machines that regularly pull files from external partners. That is the same trust relationship this bug abuses.
CISA has not listed CVE-2026-14973 in the Known Exploited Vulnerabilities catalog. No KEV entry was supplied with this record, so there is no confirmation of active exploitation and no federal remediation due date at this time.
What's Vulnerable
- Product: IBM Aspera Desktop App
- Affected versions: 1.0.5 through 1.0.19 (inclusive, semver range)
- Weakness: CWE-22; Improper Limitation of a Pathname to a Restricted Directory
- Reported by: IBM PSIRT (
[email protected])
Patch Status
The CVE was published 2026-07-28 and currently carries NVD status Received: meaning the record has not yet completed NVD analysis. No fixed version is stated in the NVD record itself. IBM's support advisory (node 7280939) is the authoritative source for remediation guidance and should be checked directly for the patched build.
No specific required action or remediation deadline is present in the supplied data.
Sources
- IBM Support Advisory; https://www.ibm.com/support/pages/node/7280939
- NVD, CVE-2026-14973, https://nvd.nist.gov/vuln/detail/CVE-2026-14973