IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

CVE-2026-14973 affects IBM Aspera Desktop App versions 1.0.5 through 1.0.19. The vulnerability allows files to be written outside of the user's selected download destination, indicating a path traversal or directory escape issue. This could allow an attacker or malicious content to place files in arbitrary locations on the user's filesystem. The scope of affected versions spans a wide range of the product lifecycle. IBM has published a support advisory addressing this issue. The vulnerability is classified with a high criticality rating. No additional technical details or exploit code are referenced in the advisory.