{"id":"CVE-2026-107188","kind":"vulnerability","aliases":["CVE-2026-107188"],"related":[],"title":"A user can upload export reports with any file contents and specify any contents","description":"A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.","summary":"Eptura Archibus: the AbCommonResources-writeHTMLtoFile workflow writes attacker-controlled content with an attacker-chosen extension to a web-browsable path. Uploading a .jspx file gives code execution as the service account (NT AUTHORITY/Local Service on Windows). Chained with the DWR auth bypass CVE-2026-107186 (isPasswordUppercase batched with runWorkflowRule), it is unauthenticated RCE.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Archibus","fixed":["2025.02","2026.01","2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576"],"affected":"< 2025.02 (2025.01 until hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576)","ecosystem":"vendor"}],"ecosystems":[],"tags":["archibus","auth-bypass-chain","eptura","java","jsp","other","rce","self-hosted"],"not_affected_if":["managed-hosting","unknown","version-2025.02-or-later"],"how_to_check":"Find Archibus Web Central servers (URL path /archibus/login.axvw) and check the version. Anything before 2025.02 is affected. 2025.01 is affected unless hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 is installed. Look for unexpected DataViewReport*.jspx files in the Archibus web directories, and for DWR calls to /archibus/dwr/call/plaincall/Multiple.*.dwr in web logs.","fix":"Upgrade to Archibus 2025.02 or 2026.01. These replace the vulnerable DWR SecurityService with a REST call, and Eptura says they need no further action. For 2025.01, install hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576, which Eptura gives to partners through its partner portal. For 2024.04 and earlier (unsupported) there is no patch. Ask Archibus Support for the web.xml changes that block the auth bypass path and stop .jspx file creation, then plan an upgrade.","status":"resolved","published_at":"2026-10-19T17:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:06:56+00:00","updated_at":"2026-10-23T23:25:39+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:06:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"An arbitrary file upload flaw lets a user upload JSP code as an export report with a JSPX extension, then browse to it to run commands on the server. Chained with a separate authentication bypass, an attacker can run code on the server without logging in.","category":"other","who_cares":["java","jsp","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the server, possibly without authentication","analyst_note":"Sources name no product, vendor or affected versions; identify the product from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-107188 and find the patched version and the authentication bypass CVE it chains with.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000446,"input_tokens":2764,"output_tokens":339,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources name no product, vendor or affected versions; identify the product from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-107188 and find the patched version and the authentication bypass CVE it chains with.","search":"'-107186':83B '-107188':17A,20A '-2026':16A,19A,82B 'abcommonresourc':39B 'abcommonresources-writehtmltofil':38B 'account':69B 'anyon':120C 'archibus':21A,22B,36B 'attack':44B,50B 'attacker-chosen':49B 'attacker-control':43B 'auth':24B,79B 'auth-bypass-chain':23B 'authent':132C,148C 'authority/local':71B 'batch':85B 'brows':122C 'browsabl':57B 'bypass':25B,80B,133C 'chain':26B,75B,137C 'chosen':51B 'code':64B,107C,143C 'command':129C 'content':10A,14A,46B,101C,105C 'control':45B 'cve':15A,18A,81B 'dwr':78B 'eptura':27B,35B 'execut':65B,130C 'export':5A,96C 'extens':52B,118C 'file':9A,62B,100C,117C,126C 'give':63B 'host':34B 'ispassworduppercas':84B 'java':28B 'jsp':29B,106C 'jspx':61B,111C 'lead':127C 'nt':70B 'path':58B 'rce':31B,91B 'report':6A,97C 'run':142C 'runworkflowrul':87B 'self':33B 'self-host':32B 'server':146C 'servic':68B,72B 'specifi':12A,103C,114C 'unauthent':90B 'upload':4A,59B,95C,110C,125C 'user':2A,93C 'vulner':134C,140C 'web':56B 'web-brows':55B 'window':74B 'without':147C 'workflow':41B 'write':42B 'writehtmltofil':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107188","severity":null,"published_at":"2026-10-19T17:17:01+00:00","modified_at":"2026-10-20T20:17:13+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107188:438","url":null,"severity":null,"published_at":"2026-10-23T23:25:39+00:00","modified_at":"2026-10-23T23:25:39+00:00","first_seen_at":"2026-10-23T23:25:39+00:00","fetched_at":"2026-10-23T23:25:39+00:00","note":"Eptura Archibus (Web Central), found by Rapid7 (Marcus Chang), disclosed 2026-10-19. Chains with auth bypass CVE-2026-107186 (and DB read CVE-2026-107187). Fix details come from Safeguard's summary of Eptura's 21 Oct notice, which I did not read directly. No exploitation known (CISA SSVC none, not in KEV). Rapid7 post has request-level detail, not a ready exploit."}],"documents":[{"id":1954,"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/","title":"Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1955,"url":"https://safeguard.sh/resources/blog/eptura-archibus-cve-2026-107186-auth-bypass-rce","title":"Safeguard: Eptura Archibus CVE-2026-107186 (summarises Eptura notice)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1956,"url":"https://www.cyber.gc.ca/en/alerts-advisories/eptura-security-advisory-av26-1062","title":"Cyber Centre AV26-1062 Eptura advisory","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}