IBM Aspera Desktop App versions 1.0.5 through 1.0.19 contain a CWE-22 path traversal vulnerability that improperly limits pathname access. This flaw enables an attacker to write files outside the intended download directory, violating directory restrictions and potentially overwriting or creating arbitrary files on the system. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. No vendor advisory or patch is currently available to address this issue.

Successful exploitation can lead to unauthorized file writes outside the designated download directory, compromising system confidentiality and integrity. This may allow attackers to overwrite critical files or place malicious files in arbitrary locations, potentially leading to further system compromise. Availability impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content or sources via the IBM Aspera Desktop App. Restricting user permissions and monitoring file system changes may help reduce risk, but no vendor-provided mitigation is currently documented.