IBM TRIRIGA CVE-2026-102627

Exploitation requires an authenticated session on the IBM TRIRIGA Application Platform (CVSS PR:L) and the ability to supply an archive that the platform extracts; the flaw lies in improper validation of file paths within archive entries during extraction (CWE-22 path traversal). No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement - the attacker must already possess valid credentials or an account on the platform - which confines exploitation to insiders or attackers who have otherwise obtained access. Affected versions are limited to TRIRIGA Application Platform 5.0.0 through 5.0.8.

This is a credible high-priority vulnerability rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a remote, low-privilege authenticated attacker can achieve arbitrary code execution via path traversal (CWE-22) during archive extraction, with no user interaction and high impact to confidentiality, integrity, and availability. The key limiting signal is PR:L - exploitation requires valid authenticated access to the TRIRIGA Application Platform, which lowers real-world exposure compared to a fully unauthenticated RCE. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk here is driven by impact potential, not observed in-the-wild activity. A vendor patch is confirmed available (IBM support node 7292037). Net: prioritize patching given the RCE impact and low attack complexity, but note that the authentication prerequisite and absence of any exploitation signal (EPSS/KEV/POC all absent) suggest this is not yet an actively weaponized threat.

An attacker who already holds valid (even low-privileged) TRIRIGA Application Platform credentials uploads or submits a maliciously crafted archive whose entries contain directory-traversal paths (e.g., ../../). During extraction the platform writes files outside the intended directory, overwriting a web-executable or application file, leading to arbitrary code execution on the server. No public exploit code was identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for an authenticated actor.