High priorityDisclosed

Advisory · CVE-2026-102627

Archive extraction path flaw in IBM TRIRIGA can execute code

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 improperly validates file paths during archive extraction, letting an authenticated attacker execute arbitrary code. IBM rates it CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
TRIRIGA Application Platform
Identifier / CWE
CVE-2026-102627
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

TRIRIGA unpacks archives without checking where the files inside want to land, so a crafted archive can drop code outside its sandbox.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sign in

    An attacker with a valid TRIRIGA account reaches the archive handling function.

  2. 02Crafted archive

    The attacker supplies an archive whose entries carry traversal paths.

  3. 03Files land outside

    Extraction writes files outside the intended directory, enabling arbitrary code execution.

What happened

IBM disclosed CVE-2026-102627 for TRIRIGA Application Platform 5.0.0 through 5.0.8. Improper validation of file paths during archive extraction (CWE-22) lets an authenticated remote attacker execute arbitrary code.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.

What to do

  1. Inventory every TRIRIGA Application Platform deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to TRIRIGA Application Platform while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for recently imported archives, files written outside TRIRIGA extraction directories, and unexpected web-accessible content.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Archive extraction bugs are a classic zip-slip route to a shell. Patch TRIRIGA and check what has been imported lately.