CVE-2026-107188: CWE-434 Unrestricted upload of file with dangerous type in Eptura Archibus

The vulnerability CWE-434 in Eptura Archibus permits users to upload export reports with arbitrary file contents and extensions, including JSP code disguised as JSPX files. Because the application does not properly restrict or validate uploaded file types, attackers can upload executable code and access it via browsing, leading to remote command execution. When chained with an authentication bypass vulnerability, this flaw enables unauthenticated remote code execution on the server.

Successful exploitation allows an attacker to execute arbitrary code on the server hosting Eptura Archibus, potentially leading to full system compromise. The vulnerability affects confidentiality and integrity with high impact, but does not directly affect availability. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

No official patch or remediation is currently listed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious file uploads. Consider isolating the application environment to limit potential damage from exploitation.