CVE-2026-10621: Collibra Agent Path Traversal in Restore Handler – Arbitrary File Write Vulnerability

Technical summary

CVE-2026-10621 is a path traversal vulnerability affecting Collibra Agent's restore functionality. The vulnerability exists because the application fails to properly validate and canonicalize file paths during ZIP archive extraction. An attacker can craft a ZIP file containing entries with path traversal sequences (such as ../ or absolute paths) that, when processed by the restore handler, extract files outside the designated extraction directory. The CVSS 3.1 score of 7.5 reflects high integrity impact with network accessibility and no authentication requirement (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Business impact

This vulnerability enables attackers to overwrite critical system files, application configuration files, or inject malicious code into executable locations without authentication. Depending on the permissions of the Collibra Agent process and the target system's configuration, successful exploitation could lead to application compromise, code execution, or lateral movement within the infrastructure. Organizations relying on Collibra for data governance should consider this a priority given the direct path to file system manipulation.

Affected systems

Collibra Agent is affected. The specific versions vulnerable to this flaw should be verified against Collibra's official security advisory, as version information is not included in this CVE record. Organizations running Collibra Agent for restore operations should inventory their deployments and confirm which versions are installed.

Exploitability

This vulnerability has a low attack complexity and requires no authentication or user interaction. An attacker can send a crafted ZIP archive to the restore handler over the network and achieve arbitrary file write. However, exploitation impact depends on the process privileges and file system permissions of the Collibra Agent service. The attack is straightforward to execute with basic ZIP manipulation tools, making it attractive to both opportunistic and targeted attackers.

Remediation

Apply the security patch released by Collibra for CVE-2026-10621. Organizations should verify patch availability through Collibra's security advisories and update all instances of Collibra Agent in their environment. Until patching is complete, consider restricting network access to the restore handler endpoint and reviewing access controls to the service.

Patch guidance

Consult Collibra's official security advisory for the specific patched version numbers and update procedures. Test patches in a non-production environment before deployment to ensure compatibility with your data governance workflows. Given the network-accessible nature of this flaw, prioritize patching in externally exposed instances first, then move to internal deployments.

Detection guidance

Monitor for suspicious ZIP uploads to Collibra Agent restore endpoints, particularly those containing path traversal patterns (../, absolute paths, or unusual directory structures). Review file system access logs for unexpected file creation or modification outside the normal Collibra Agent directories. Enable detailed logging on the restore handler if available. Look for restore operations that generate files in system directories or executable paths.

Why prioritize this

The combination of network accessibility, zero authentication requirement, and high integrity impact makes this vulnerability a priority. While no active exploitation has been added to the KEV catalog, the ease of crafting a malicious ZIP and the potential for code execution or critical file overwrite warrant immediate attention. Organizations using Collibra for data governance should patch promptly.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the severity: network vector, low complexity, no privileges or user interaction required, and high integrity impact. The lack of confidentiality or availability impact prevents a critical rating, but the unimpeded ability to write arbitrary files to the file system justifies the HIGH designation. Real-world risk depends on process permissions and network exposure.

Frequently asked questions