CRITICAL 9.6 NVD

CVE-2026-107188

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and any

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

References

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-databa

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-10-19 via NVD.

Risk Timeline

CVE Disclosed2026-10-19 · -1 days ago

Remediation Resources

Official Advisory

www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-executio

vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.