CVE-2026-42291

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.

SysReptor prior to 2026.68 does not rotate the session identifier after successful password authentication for protected shared notes, allowing session fixation. An attacker can reuse the fixed session after the victim authenticates to the shared note. The main SysReptor login flow is not affected.

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory.

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token.

SysReptor prior to 2026.55 discloses project-wide collaborative editing metadata to an unauthenticated holder of a public note share link. The metadata can reveal usernames, note identifiers, and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access.

In SysReptor before version 2026.29, users with "User Admin" permissions can change email addresses of "Superuser" users. If "Forgot Password" is enabled, they can reset the superuser's password and access the Django backend and manipulate settings.

SysReptor prior to 2025.102 contains a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI.

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.