Executive brief
Collibra Agent, a service used to manage enterprise data assets, contains a vulnerability in how it handles file restorations. An attacker can exploit this by sending a specially crafted ZIP file that places malicious files in sensitive areas of the server's storage. This can lead to a total system takeover, allowing unauthorized parties to steal data, disrupt operations, or install persistent backdoors.
Technical details
A 'Zip Slip' path traversal vulnerability exists in the restore handler of the Collibra Agent. The vulnerability is located in the POST /rest/restore endpoint, where the application fails to properly validate or canonicalize file paths within a ZIP archive during extraction. By using directory traversal sequences (e.g., ../), a remote attacker can write files outside the intended directory. When chained with CVE-2026-10622 (improper authentication on the same REST endpoints), an unauthenticated attacker can upload a malicious JSP file to a web-accessible directory to achieve remote code execution (RCE). Collibra has released patches for both SaaS and Self-Hosted versions.
Affected products
- Collibra Collibra Platform Agent SaaS: 2026.05, 2026.04.5, 2026.03.4, 2026.02.6, 2025.11.7, 2025.10.9; Self-Hosted: 2026.03 (Build 2026.03.356), 2025.10 (Build 2025.10.399)
Timeline
- 2026-03-06: other: Vendor notified
- 2026-06-02: disclosed: Vulnerability made public
- 2026-06-02: patched: Fixed versions released