CVE-2026-102627

Received Received - Intake

IBM TRIRIGA Arbitrary Code Execution via Archive Extraction

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-102627

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	TRIRIGA	Application Platform 5.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 has a vulnerability where a remote authenticated attacker can execute arbitrary code. This happens because the system does not properly validate file paths when extracting archives, allowing malicious files to be processed.

Impact Analysis

An attacker could exploit this to run unauthorized code on your system, potentially stealing data, installing malware, or disrupting services. Since it requires authentication, attackers need valid credentials but could escalate privileges if successful.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Non-compliance may result in fines, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade IBM TRIRIGA Application Platform to a version beyond 5.0.8 where the file path validation during archive extraction has been fixed.

Hi! I’m here to help you understand CVE-2026-102627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70