---
id: "CVE-2026-107188"
kind: "vulnerability"
aliases: ["CVE-2026-107188"]
title: "A user can upload export reports with any file contents and specify any contents"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "resolved"
category: "other"
products: [{"name": "Archibus", "fixed": ["2025.02", "2026.01", "2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576"], "affected": "< 2025.02 (2025.01 until hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["archibus", "auth-bypass-chain", "eptura", "java", "jsp", "other", "rce", "self-hosted"]
not_affected_if: ["managed-hosting", "unknown", "version-2025.02-or-later"]
published_at: "2026-10-19T17:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-23T23:25:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107188", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:25:39+00:00"}]
---

# A user can upload export reports with any file contents and specify any contents

Eptura Archibus: the AbCommonResources-writeHTMLtoFile workflow writes attacker-controlled content with an attacker-chosen extension to a web-browsable path. Uploading a .jspx file gives code execution as the service account (NT AUTHORITY/Local Service on Windows). Chained with the DWR auth bypass CVE-2026-107186 (isPasswordUppercase batched with runWorkflowRule), it is unauthenticated RCE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Archibus affected < 2025.02 (2025.01 until hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576) fixed 2025.02, 2026.01, 2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576

## How to check

Find Archibus Web Central servers (URL path /archibus/login.axvw) and check the version. Anything before 2025.02 is affected. 2025.01 is affected unless hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 is installed. Look for unexpected DataViewReport*.jspx files in the Archibus web directories, and for DWR calls to /archibus/dwr/call/plaincall/Multiple.*.dwr in web logs.

## Fix

Upgrade to Archibus 2025.02 or 2026.01. These replace the vulnerable DWR SecurityService with a REST call, and Eptura says they need no further action. For 2025.01, install hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576, which Eptura gives to partners through its partner portal. For 2024.04 and earlier (unsupported) there is no patch. Ask Archibus Support for the web.xml changes that block the auth bypass path and stop .jspx file creation, then plan an upgrade.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107188
- 2026-10-23T23:25:39+00:00 analyst — Eptura Archibus (Web Central), found by Rapid7 (Marcus Chang), disclosed 2026-10-19. Chains with auth bypass CVE-2026-107186 (and DB read CVE-2026-107187). Fix details come from Safeguard's summary of Eptura's 21 Oct notice, which I did not read directly. No exploitation known (CISA SSVC none, not in KEV). Rapid7 post has request-level detail, not a ready exploit.

## Documents

- [advisory] Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/
- [fix] Safeguard: Eptura Archibus CVE-2026-107186 (summarises Eptura notice) https://safeguard.sh/resources/blog/eptura-archibus-cve-2026-107186-auth-bypass-rce
- [mentions] Cyber Centre AV26-1062 Eptura advisory https://www.cyber.gc.ca/en/alerts-advisories/eptura-security-advisory-av26-1062

## From the sources

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_