CVE-2026-81179
HighCVSS 8.1Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token.
Risk Assessment
A victim who clicks the link may disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim.
Recommendation
Update SysReptor to version 2026.58 or later. Avoid using wildcards in ALLOWED_HOSTS and consider restricting the Host header at the reverse proxy level.
Other vulnerabilities in SysReptor
See all- CVE-2026-81182Medium
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
- CVE-2026-81181Low
SysReptor prior to 2026.68 does not rotate the session identifier after successful password authentication for protected shared notes, allowing session fixation. An attacker can reuse the fixed session after the victim authenticates to the shared note. The main SysReptor login flow is not affected.
- CVE-2026-81180High
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory.
- CVE-2026-81178Low
SysReptor prior to 2026.55 discloses project-wide collaborative editing metadata to an unauthenticated holder of a public note share link. The metadata can reveal usernames, note identifiers, and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access.
- CVE-2026-44987Low
In SysReptor before version 2026.29, users with "User Admin" permissions can change email addresses of "Superuser" users. If "Forgot Password" is enabled, they can reset the superuser's password and access the Django backend and manipulate settings.
Original NVD description (English source)
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.