CVE-2026-107188

9.6 CRITICAL

Published 2026-10-19 · Updated 2026-10-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-434

All references

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2023-54405PoC
HIGHCVE-2025-15700
HIGHCVE-2026-100389
MEDIUMCVE-2026-101071PoC
HIGHCVE-2026-102130PoC
MEDIUMCVE-2026-102137PoC
HIGHCVE-2026-102143PoC
MEDIUMCVE-2026-102263

Related by shared AI tags and CWE weakness class. Browse the full archive.