Critical severity9.6NVD Advisory· Published Oct 19, 2026

CVE-2026-107188

Description

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Eptura/Archibusllm-fuzzy

Patches

Vulnerability mechanics

References

www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/nvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000