File Upload Vulnerability in Eptura Archibus by Eptura
CVE-2026-107188

9.6CRITICAL

Key Information:

Vendor

Eptura

Status
Archibus
Vendor
CVE Published:
19 October 2026

What is CVE-2026-107188?

This vulnerability allows unauthorized users to upload documents with arbitrary content, including JSP code. When users specify the JSPX file extension, the uploaded file can be accessed by any user, potentially leading to unauthorized remote code execution. Furthermore, when combined with an authentication bypass vulnerability, it could enable attackers to execute malicious commands on the server without needing valid user credentials. This poses a significant security risk, potentially compromising sensitive data and system integrity.

Affected Version(s)

Archibus 0 < 2025.02

References

https://www.rapid7.com/blog/post/ve-authentication-bypass...
related

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Chang, Security Consultant, Rapid7
.