CVE-2026-107188

Name of the Vulnerable Software and Affected Versions Eptura Archibus versions prior to 2025.02

Description An unauthenticated arbitrary file upload issue allows attackers to upload files with any content, including JSP and JSPX scripts, via the export reports feature. Because these uploaded files can be accessed through a browser, this can lead to remote command execution on the server. This issue can be chained with an authentication bypass to execute code without valid credentials.

Recommendations Upgrade to Archibus version 2025.02 or later. Block external access to the report export functionality.