What is GHSA-pv68-m9mv-v63w?

GHSA-pv68-m9mv-v63w is a security advisory published by GitHub Security Advisories with Critical severity. A user can upload export reports with any file contents and specify any contents. JSP code can be...

Which CVE IDs does GHSA-pv68-m9mv-v63w cover?

GHSA-pv68-m9mv-v63w covers the following CVE IDs: CVE-2026-107188. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pv68-m9mv-v63w?

GHSA-pv68-m9mv-v63w has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

GHSA-pv68-m9mv-v63wCriticalCVSS 9.6

A user can upload export reports with any file contents and specify any contents. JSP code can be...

Vendor

GitHub Security Advisories

Published

October 19, 2026

Last Modified

October 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-107188 →

📋 Description

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107188
https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed
https://github.com/advisories/GHSA-pv68-m9mv-v63w