Key points
- The vulnerability allows unauthenticated remote code execution via malicious report uploads.
- It affects Eptura Archibus installations running versions prior to the 2025.02 release.
- The flaw can be chained with an authentication bypass to access systems without credentials.
Attackers gain the ability to execute arbitrary commands on servers running Eptura Archibus by uploading specially crafted files. This capability exists because the application permits users to upload export reports with unrestricted file contents and extensions. According to the National Vulnerability Database, this flaw is rated critical with a CVSS score of 9.6, indicating severe risk to affected systems.
In plain English
The issue stems from how the software handles file uploads. Users can submit report files that the system saves without checking their actual content or type. An attacker can disguise a malicious script as a report file, using a JSPX extension. Once uploaded, any visitor to the site can access and trigger this file, causing the server to run the attacker’s code.
The background
This specific vulnerability is tracked as CVE-2026-107188. It applies to Eptura Archibus versions released before the 2025.02 update. The National Vulnerability Database classifies the weakness under CWE-434, which relates to unrestricted upload of executable files. The source material notes that this upload flaw can be combined with a separate authentication bypass vulnerability. This chaining allows attackers to run code on the server without needing valid login credentials, significantly lowering the barrier for exploitation.
What changes now
Organisations using Eptura Archibus must verify their current version against the 2025.02 release. Any installation running an older version is exposed to this critical risk. While no fix has been confirmed for versions that cannot be updated, the primary mitigation is upgrading to the patched release. Until then, the ability for unauthenticated users to upload and execute files remains a severe exposure for managed service providers overseeing these environments.
The attacker's path
Teams usually monitor for unusual file uploads that do not match expected report formats. Check whether your environment allows unrestricted file extensions in upload modules. This stage of an intrusion serves as an initial foothold, granting remote code execution. Attackers often chain such upload flaws with other weaknesses to bypass authentication. Understanding this pattern helps defenders prioritise patching and input validation reviews.
Background: File upload vulnerabilities
Monitor for unexpected MIME types, rapid sequential uploads, and execution attempts from storage directories. Combine server-side validation with strict content-type checking. Review file naming patterns for double extensions. Use automated scanning to find misconfigurations that allow script execution in upload folders.
Read the full guide: Detect File Upload Vulnerabilities: Log Signals and Blind Spots
What to do and how to stay safe: Eptura Archibus
- Verify if your Eptura Archibus installation is running a version prior to 2025.02.
- Restrict file upload capabilities to trusted internal networks if immediate patching is not possible.
- Monitor server logs for unexpected execution of JSP or JSPX files.
- Review access controls to ensure unauthenticated users cannot trigger uploaded content.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-107188 as critical with a CVSS score of 9.6.
Which versions of Eptura Archibus are affected?
All versions of Eptura Archibus released before the 2025.02 update are affected by this flaw.
Can this flaw be exploited without logging in?
Yes, it can be chained with an authentication bypass vulnerability to run code without authentication.
