Archibus Report Upload Flaw Enables Remote Code Execution via JSP

Eptura Archibus contains a critical vulnerability that permits the upload of malicious files through its report export functionality. According to the National Vulnerability Database, this flaw allows a user to specify arbitrary file contents and extensions, including JSPX. When combined with a separate authentication bypass issue, attackers can execute commands on the server without valid credentials. This creates a high-severity risk for organizations running affected versions of the facility management platform.

Root cause

The underlying issue, tracked as CVE-2026-107188, stems from insufficient validation during the report export process. The application permits users to upload files with unrestricted content. An attacker can specify a JSPX extension for the uploaded data. Because the server processes these files, the uploaded JavaServer Pages code is executed when accessed. The NVD assigns a CVSS score of 9.6 to this weakness, classifying it as Critical.

Attack path

Exploitation requires two distinct steps to achieve full unauthenticated access. First, an attacker leverages an authentication bypass vulnerability to gain entry to the system without valid login credentials. Second, the attacker uses this access to upload a malicious JSP file via the report export feature. Once uploaded, the attacker browses to the file location. The server executes the embedded code, granting the attacker command execution capabilities on the underlying host.

Affected versions

• Eptura Archibus versions prior to 2025.02 are vulnerable to this issue.
• The National Vulnerability Database lists CVE-2026-107188 specifically for releases before this version.
• Organizations must verify their current software version against this threshold to determine exposure.

Mitigation

• Monitor for unauthorized file uploads in application logs and web server directories.
• Restrict network access to the report export endpoints if possible.
• Ensure authentication mechanisms are robust to prevent the initial bypass step.
• No confirmed fix has been announced; watch for vendor updates.

Detection notes

Security teams should monitor web server logs for unusual HTTP requests targeting JSPX or similar executable extensions. Look for POST requests to report export endpoints that include large or binary payloads. Alert on any file creation events in temporary directories associated with the application. Check for outbound connections from the web server to unknown external IPs, which may indicate command and control activity. Review access logs for successful requests to recently created files, especially if accessed by unauthenticated users.

What to do and how to stay safe: Eptura

• Verify your current Eptura Archibus version and compare it to the vendor's advisory.
• Implement web application firewall rules to block uploads of executable file types.
• Conduct a thorough review of server logs for signs of prior compromise or unauthorized access.
• Wait for the vendor to provide an update before assuming the issue is resolved.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107188?

The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.6.

Which versions of Archibus are affected?

All versions of Eptura Archibus prior to 2025.02 are vulnerable to this issue.

Can this vulnerability be exploited without authentication?

Yes, but only if chained with a separate authentication bypass vulnerability.