CVE-2026-81180: SysReptor: Authenticated RCE by insecure image processing
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SysReptorto a version that resolves this vulnerability.Fixed in 2026.61 - Upgrade
Upgrade
SysReptorto a version that resolves this vulnerability.Fixed in 2026.58
Event History
Frequently Asked Questions
Which deployments are affected?
Only SysReptor Professional deployments before version 2026.61 are affected. The Community edition is not affected.
What access does an attacker need?
An attacker needs an authenticated SysReptor Professional account and the ability to upload crafted image files. No user interaction is required.
What privileges does successful code execution have?
The injected Python code executes with the privileges of the SysReptor application process, following a worker restart.
Is upgrading to version 2026.58 sufficient?
No. Version 2026.58 includes only a partial mitigation; the issue is fully fixed in version 2026.61.