CVE-2026-102627
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
Risk Assessment
A remote authenticated attacker can execute arbitrary code in the application context. This leads to full system compromise and violation of its confidentiality and integrity.
Recommendation
Update IBM TRIRIGA Application Platform to a patched version. Until patched, restrict access to archive extraction features and validate uploaded files.
Other vulnerabilities in IBM TRIRIGA Application Platform
See all- CVE-2017-1373High
The IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute a report they do not have access to.
- CVE-2017-1371High
Builder tools running in the IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to.
- CVE-2016-0386High
CVE-2016-0386 describes a CSRF vulnerability in IBM TRIRIGA Application Platform that allows remote authenticated users to hijack the authentication of administrators for requests that delete employees. It affects versions before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2.
- CVE-2016-0374High
The builder tools in IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.
- CVE-2016-0362High
IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to conduct server-side request forgery (SSRF) attacks. Attackers can trigger network traffic to arbitrary intranet or Internet hosts via a crafted proxy request to a web service.
- CVE-2014-4840High
IBM TRIRIGA Application Platform versions 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.
- CVE-2026-93892High
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.
- CVE-2026-93891High
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
- CVE-2026-11372Medium
IBM TRIRIGA Application Platform versions 5.0.2 through 5.0.3 are vulnerable to cross-site scripting (XSS). An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially leading to credential disclosure within a trusted session.
Original NVD description (English source)
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS