Live › vulnerability › CVE-2026-107188
Go to dashboardEptura Archibus: the AbCommonResources-writeHTMLtoFile workflow writes attacker-controlled content with an attacker-chosen extension to a web-browsable path. Uploading a .jspx file gives code execution as the service account (NT AUTHORITY/Local Service on Windows). Chained with the DWR auth bypass CVE-2026-107186 (isPasswordUppercase batched with runWorkflowRule), it is unauthenticated RCE.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Archibus | vendor | < 2025.02 (2025.01 until hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576) | 2025.02, 2026.01, 2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-107188")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.