CVE-2026-52607: Reportico reportico-web vulnerability

Q: Which deployments should be investigated?

Systems running reportico-web version 8.1.0 or earlier are identified as affected. The vulnerable request is handled by the run.php endpoint.

Q: What does an attacker need to do to exploit this issue?

An attacker needs remote access to the run.php endpoint and can supply a filename through the target_format parameter while setting execute_mode to EXECUTE. This can expose or execute arbitrary PHP files on the web server.

Published Aug 18, 2026

Updated

A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint.

Affected Software

1 affected component

Reportico reportico-web<=8.1.0

Event History

Aug 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments should be investigated?

Systems running reportico-web version 8.1.0 or earlier are identified as affected. The vulnerable request is handled by the run.php endpoint.

What does an attacker need to do to exploit this issue?

An attacker needs remote access to the run.php endpoint and can supply a filename through the target_format parameter while setting execute_mode to EXECUTE. This can expose or execute arbitrary PHP files on the web server.