CVE-2026-52608: Reportico-web vulnerability

Q: Does enabling safe_mode prevent exploitation?

No. The vulnerability can be exploited regardless of the safe_mode setting.

Q: Does an attacker need an account or existing access to exploit this issue?

No authentication is required. An unauthenticated attacker can inject PHP code through the affected report attribute.

Q: Is exposure limited to specific reports?

Any report is affected because the vulnerable PreExecuteCode attribute can be modified for arbitrary reports.

Published Aug 18, 2026

Updated

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution.

Affected Software

1 affected component

reportico-web<=8.1.0

Event History

Aug 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Does enabling safe_mode prevent exploitation?

No. The vulnerability can be exploited regardless of the safe_mode setting.

Does an attacker need an account or existing access to exploit this issue?

No authentication is required. An unauthenticated attacker can inject PHP code through the affected report attribute.

Is exposure limited to specific reports?

Any report is affected because the vulnerable PreExecuteCode attribute can be modified for arbitrary reports.