Zero Radar
← feed
CriticalVulnerabilityCVE-2026-107188updated 25 Oct 2026, 15:20 UTC

Export report upload allows server code execution without login

An attacker can upload a file that the server then runs as program code, so they can take control of the server. Combined with a separate login bypass, no password is needed.

Official, 2 sources
SeverityCriticalCVSS 9.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker uploads fileExport report upload accepts any contents
  2. 2JSPX extension acceptedAttacker chooses file extension
  3. 3File stored web-reachableAnyone can browse to the file
  4. 4Code executes on serverChained with auth bypass, no login needed
  5. ResultAttacker controls the server

What happened

Export report upload accepts arbitrary file contents and an attacker-chosen extension (JSPX), so uploaded JSP code is stored in a web-reachable location and executed when requested. The flaw is chained with an authentication bypass to run code without authentication.

Why it is dangerous: Anyone who can reach the affected application over the network can run commands on the server, potentially reading or changing its data and using it to reach other systems.

Are you affected?

You are affected if you run the affected product with its export report upload feature exposed to the network, and the product version is unknown from the provided material.

What to do

  1. Check the vendor advisory GHSA-pv68-m9mv-v63w for the patched version and update to it
  2. Restrict network access to the application until it is patched, especially to the export report feature
  3. Review the server for unexpected uploaded JSP or JSPX files and remove any you did not create

Timeline

  1. 19 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 19 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-107188 · GHSA-pv68-m9mv-v63w
CVSS
9.6 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
19 Oct 2026, 17:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Export report upload allows server code execution without login · Zero Radar