IBM Aspera Desktop App is vulnerable to a path traversal flaw that permits an attacker to write or overwrite files outside the intended download directory. This gives the user control over the creation or modification of arbitrary files on the host system, potentially resulting in the replacement of critical files, installation of malware, or other destructive actions. The weakness is identified as a classic input validation failure (CWE‑22).

The vulnerability exists in IBM Aspera Desktop App versions 1.0.5 through 1.0.19. Users running any of these releases are affected. The fix is available in version 1.1.0, which can be obtained via the application’s update mechanism or from the IBM Aspera downloads site.

The CVSS score of 9.3 signals a high severity vulnerability. The EPSS score of less than 1% indicates that, at present, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is exercised by locally running the application and providing a crafted path, the attack vector is primarily local. An attacker must have access to the desktop where the application is installed, but no network or elevated privileges are required to trigger the write outside the target directory.