CVE-2026-52607

Deferred Deferred - Pending Action

Directory Traversal in Reportico Web via run.php

Publication date: 2026-08-18

Last updated on: 2026-08-31

Assigner: MITRE

Description

A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-31

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52607

EUVD

EUVD-2026-61097

Affected Vendors & Products

Vendor	Product	Version / Range
reportico	reportico	to 8.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a directory traversal vulnerability in reportico-web versions 8.1.0 and earlier. It allows remote attackers to access or execute arbitrary PHP files on the web server by manipulating the target_format parameter combined with execute_mode=EXECUTE in the run.php endpoint. Attackers can specify a directory traversal path to a PHP file without including the file extension.

Detection Guidance

To detect this vulnerability, check if your Reportico-web version is 8.1.0 or earlier. Test by accessing the run.php endpoint with crafted parameters like target_format=../../../../etc/passwd and execute_mode=EXECUTE. If the server responds with sensitive files or executes unintended PHP files, the system is vulnerable.

Impact Analysis

An attacker could read sensitive files, execute malicious PHP code, or gain unauthorized access to the server. This could lead to data breaches, system compromise, or further network infiltration depending on the server's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade Reportico-web to a version beyond 8.1.0 if available. If no patch exists, restrict access to the run.php endpoint via web server rules or disable it entirely. Monitor network traffic for suspicious requests targeting this parameter combination.

Hi! I’m here to help you understand CVE-2026-52607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70