Description
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
Published: 2026-10-12
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 contain an improper validation of file paths when extracting archive files, which can allow a remote authenticated attacker to decompress a crafted archive that places files outside the intended directory. This flaw can lead to arbitrary code execution on the server hosting the application, compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

The vulnerability affects IBM TRIRIGA Application Platform, specifically versions 5.0.0 through 5.0.8, as referenced by the IBM product and associated CPE entries.

Risk and Exploitability

The flaw has a CVSS score of 8.8, indicating high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user who can upload or trigger the extraction of archive files; the attacker would need user privileges on the application to provide or trigger the malicious archive. Once the flawed extraction occurs, attacker code may execute with the privileges of the application process.

Generated by OpenCVE AI on October 13, 2026 at 00:40 UTC.

Remediation

Vendor Solution

Customers using affected versions of IBM TRIRIGA should upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release containing the fix. IBM recommends applying the latest available maintenance to ensure protection against this vulnerability. https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+TRIRIGA+Application+Platform&release=5.0.8&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM TRIRIGA Application Platform to version 5.0.9 or later, which includes the security fix.
  • Apply the latest available maintenance release to ensure all security patches are in place.
  • Restrict archive extraction and file upload capabilities to privileged users only or disable these functions when not required.
  • Implement input validation to ensure extracted file paths remain within the intended directory before writing to disk.

Generated by OpenCVE AI on October 13, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
Title Security Vulnerability identified in IBM TRIRIGA - Zip Slip
First Time appeared Ibm
Ibm tririga Application Platform
Weaknesses CWE-22
CPEs cpe:2.3:a:ibm:tririga_application_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:5.0.8:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm tririga Application Platform
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Tririga Application Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:48:19.639Z

Reserved: 2026-09-29T15:02:48.131Z

Link: CVE-2026-102627

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T23:17:19.457

Modified: 2026-10-12T23:17:19.457

Link: CVE-2026-102627

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:45:18Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')