CVE-2026-52610: Reportico reportico-web vulnerability

Q: Which systems are realistically exposed?

Any deployment of reportico-web version 8.1.0 or earlier with the run.php endpoint reachable by a remote attacker is exposed. The impact is limited by the filesystem permissions of the web-server user, but files writable by that user can be created or overwritten outside the intended directory.

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to send a request to run.php that supplies a filename through saveTemplate and sets execute_mode=PREPARE. No authentication requirement or other precondition is stated in the available data.

Q: How can defenders look for signs of exploitation?

Review requests to run.php for execute_mode=PREPARE combined with saveTemplate values containing directory-traversal sequences or unexpected absolute paths. Also inspect files writable by the web-server user for unexpected creations or modifications.

Published Aug 18, 2026

Updated

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with "executemode=PREPARE" parameter in the "run.php" endpoint.

Affected Software

1 affected component

Reportico reportico-web<=8.1.0

Event History

Aug 18, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which systems are realistically exposed?

Any deployment of reportico-web version 8.1.0 or earlier with the run.php endpoint reachable by a remote attacker is exposed. The impact is limited by the filesystem permissions of the web-server user, but files writable by that user can be created or overwritten outside the intended directory.

What does an attacker need to exploit this issue?

An attacker needs to be able to send a request to run.php that supplies a filename through saveTemplate and sets execute_mode=PREPARE. No authentication requirement or other precondition is stated in the available data.

How can defenders look for signs of exploitation?

Review requests to run.php for execute_mode=PREPARE combined with saveTemplate values containing directory-traversal sequences or unexpected absolute paths. Also inspect files writable by the web-server user for unexpected creations or modifications.