CVE-2026-107188CWE-434unrestricted-file-upload

CVE-2026-107188

Critical · published October 19, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-10-19T21:17Z
References (1)
https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/ · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 16:37Z
    Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
    cvelistv5
  • 19 OCT 16:37Z
    Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
    cvelistv5