CVE-2026-107188 PUBLISHED

Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

Assigner: rapid7
Reserved: 07.10.2026 Published: 19.10.2026 Updated: 19.10.2026

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS Score: 9.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Eptura
Product	Archibus
Versions	Default: unaffected affected from 0 to 2025.02 (excl.)

Credits

Marcus Chang, Security Consultant, Rapid7 finder

References

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/

Problem Types

CWE-434 Unrestricted upload of file with dangerous type CWE