VULNERABILITY INTELLIGENCE
CVE-2026-107188
CVSS score9.6 CRITICAL
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-10-19
Last modified2026-10-20
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Description
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
Weakness classification
- CWE-434: Unrestricted Upload of File with Dangerous Type