CISA issues Collibra Agent fixes for /rest and ZIP traversal

Collibra Platform Agent contains issues that allow a remote, unauthenticated attacker to chain vulnerabilities to reach remote code execution. The problems involve privileged REST endpoints exposed under /rest/* and a ZIP extraction path traversal condition in the restore handler. Successful exploitation includes writing attacker-controlled files to arbitrary locations and enabling code execution through subsequent web access.

The Collibra Platform (CP) and Collibra Platform Self-Hosted (CPSH) agents are independent services installed on the host system and listen on different ports than the web interface. For CVE-2026-10622, privileged REST endpoints exposed under /rest/* do not properly enforce authentication or authorization, allowing a remote unauthenticated attacker to interact with sensitive application functionality and gather information useful for further exploitation, including identifying suitable filesystem locations or application paths. The web services hosting the vulnerable REST endpoint were observed to bind to all available network interfaces regardless of the setting passed to the installer script. For CVE-2026-10621, a Zip Slip vulnerability during extraction is exposed through POST /rest/restore and enables path traversal because file paths in a ZIP archive are not properly validated or canonicalized before extraction. A remote attacker can supply a crafted ZIP archive containing directory traversal sequences, such as ../, to write files outside the intended extraction directory. In an observed exploitation path, this arbitrary file write can be used to place a malicious JSP file into a web-accessible directory, enabling remote code execution when the file is subsequently requested over HTTP.

A remote, unauthenticated attacker can chain these vulnerabilities to achieve remote code execution on the affected system. An attacker who successfully exploits these issues may be able to install a persistent web shell, read, modify, or delete application data, disrupt system availability, and potentially pivot further into surrounding environment. Because exploitation does not require authentication, deployments reachable across the public internet may be at significant risk.

Collibra released versions to address the vulnerabilities. For Collibra Platform (SaaS), the listed fixed releases are 2026.05, 2026.04.5, 2026.03.4, 2026.02.6, 2025.11.7, and 2025.10.9. For Collibra Platform Self Hosted (on-prem), the listed fixed releases are 2026.03 (Build 2026.03.356) and 2025.10 (Build 2025.10.399). Users are strongly encouraged to update to the fixed release as soon as possible. Refer to Collibra documentation and release notes for patching and deployment guidance. Administrators should ensure that interfaces exposing REST endpoints are not exposed to untrusted networks and should restrict access to management interfaces wherever possible.

Additional advisory notes identify VU#873170.2 as path traversal in the restore handler in the Collibra Agent, where the agent fails to properly validate and canonicalize file path during ZIP extraction, allowing an attacker to write files outside the intended extraction directory. VU#873170.1 is identified as improper authentication in the REST API in the Collibra Agent, where a remote unauthenticated attacker can access privileged functionality via exposed /rest/* endpoints.

Blog post, originally published by Michael Bragg at kb.cert.org.