CVE-2026-52608

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary PHP code into the PreExecuteCode attribute of any report regardless of the safe_mode setting, leading to remote code execution.

Risk Assessment

An attacker can take over the server, execute malicious code, and compromise the confidentiality, integrity, and availability of the system.

Recommendation

Update reportico-web to the latest version that fixes this vulnerability and restrict access to the application to trusted users only.

Original NVD description (English source)

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.