CVE-2026-102627 PUBLISHED

Security Vulnerability identified in IBM TRIRIGA - Zip Slip

Assigner: ibm
Reserved: 29.09.2026 Published: 12.10.2026 Updated: 13.10.2026

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	IBM
Product	TRIRIGA Application Platform
Versions	affected from 5.0.0 to 5.0.8 (incl.)

Solutions

Customers using affected versions of IBM TRIRIGA should upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release containing the fix. IBM recommends applying the latest available maintenance to ensure protection against this vulnerability.

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+TRIRIGA+Application+Platform&release=5.0.8&platform=All&function=all

References

https://www.ibm.com/support/pages/node/7292037

Problem Types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE