CVE-2026-107188
9.6CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-434
Impact
Attackers can achieve remote code execution on the server by uploading arbitrary JSP/JSPX files, which can be reached unauthenticated if chained with an auth bypass bug. They need network access to the report export functionality and a valid low-privileged account, or an auth bypass exploit.
Root cause
The report export feature accepts arbitrary file contents and allows setting executable extensions like JSPX without validation or upload directory restrictions.
Affected systems
Eptura Archibus (exact affected versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade Eptura Archibus to the fixed release specified in the vendor advisory. If you cannot patch immediately, block public network access to the web interface or restrict access to the file upload and export endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.