CVE-2026-52608
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary PHP code into the PreExecuteCode attribute of any report regardless of the safe_mode setting, leading to remote code execution.
Risk Assessment
An attacker can take over the server, execute malicious code, and compromise the confidentiality, integrity, and availability of the system.
Recommendation
Update reportico-web to the latest version that fixes this vulnerability and restrict access to the application to trusted users only.
Other vulnerabilities in reportico-web
See all- CVE-2026-52610Critical
An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjunction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.
- CVE-2026-52609Medium
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in conjunction with the execute_mode=CRITERIA parameter of run.php.
- CVE-2026-52607Medium
A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary PHP files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.
- CVE-2026-52606Medium
A reflected XSS vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in a user's browser by including a malicious payload in the loadTemplate parameter with execute_mode=PREPARE in run.php.
Original NVD description (English source)
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS