CVE-2026-10621

HighCVSS 7.5

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

Path traversal vulnerability in the restore handler of Collibra Agent. An attacker can write arbitrary files outside the intended extraction directory via a crafted ZIP archive. The agent fails to properly validate and canonicalize file paths during extraction.

Risk Assessment

The risk involves overwriting critical system or configuration files, potentially leading to server compromise or data exfiltration.

Recommendation

Immediately update Collibra Agent to a patched version and implement path validation during archive extraction.

Other vulnerabilities in Collibra Agent

CVE-2026-10622High
Improper Authentication in REST API in Collibra Agent allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.

Original NVD description (English source)

Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.