CVE-2026-102627

{
  "etk_id": "ETK-2026-1432",
  "cve_id": "CVE-2026-102627",
  "display_id": "CVE-2026-102627",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-98083",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Archive extraction path traversal in IBM TRIRIGA",
  "summary": "IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are affected by path validation weaknesses during archive extraction. An authenticated remote attacker may be able to execute code by abusing this processing, so an account with access to the relevant archive-handling feature is required.",
  "mitigation": "Restrict archive upload and extraction functions to trusted administrators and review authenticated access to those features. Apply an IBM-provided update when one is available; the advisory does not record a fixed version.",
  "vendor": "IBM",
  "product": "TRIRIGA Application Platform",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, <= 5.0.8"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "TRIRIGA Application Platform",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0053,
  "epss_percentile": 0.434,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 33.49202416666667,
  "t0_at": "2026-10-12T22:47:59.081000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T22:47:59.081000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T22:47:59.081000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102627"
    }
  }
}