CVE-2026-52610

Deferred Deferred - Pending Action

Arbitrary File Write in Reportico Web via Directory Traversal

Publication date: 2026-08-18

Last updated on: 2026-08-31

Assigner: MITRE

Description

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-31

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52610

EUVD

EUVD-2026-61092

Affected Vendors & Products

Vendor	Product	Version / Range
reportico	reportico	to 8.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-52610 is an arbitrary file write vulnerability in reportico-web versions 8.1.0 and earlier. It allows remote attackers to create or overwrite files anywhere on the filesystem with the permissions of the web user by exploiting the saveTemplate parameter and execute_mode=PREPARE in run.php.

Detection Guidance

Check for suspicious POST requests to run.php with parameters execute_mode=PREPARE and saveTemplate containing path traversal sequences like /../../../. Monitor for unexpected file creation in web-accessible directories.

Impact Analysis

An attacker could upload a PHP shell to execute arbitrary commands on the server. This could lead to full system compromise, data theft, or further network infiltration depending on the server's role and permissions.

Compliance Impact

This vulnerability could lead to unauthorized file access or code execution, potentially violating data protection requirements under GDPR or HIPAA. Organizations may face compliance breaches if sensitive data is exposed or modified due to the flaw.

Mitigation Strategies

Upgrade reportico-web to a version beyond 8.1.0 if available. If not, restrict write permissions to web directories and disable execute_mode=PREPARE in run.php. Block malicious POST requests via WAF rules.

Hi! I’m here to help you understand CVE-2026-52610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70