CVE-2026-52610
Received Received - Intake

Arbitrary File Write in Reportico Web via Directory Traversal

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: MITRE

Description
An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-52610
EUVD
EUVD-2026-61092

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
reportico reportico to 8.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52610 is an arbitrary file write vulnerability in reportico-web versions 8.1.0 and earlier. It allows remote attackers to create or overwrite files anywhere on the filesystem with the permissions of the web user by exploiting the saveTemplate parameter and execute_mode=PREPARE in run.php.

Detection Guidance

Check for suspicious POST requests to run.php with parameters execute_mode=PREPARE and saveTemplate containing path traversal sequences like /../../../. Monitor for unexpected file creation in web-accessible directories.

Impact Analysis

An attacker could upload a PHP shell to execute arbitrary commands on the server. This could lead to full system compromise, data theft, or further network infiltration depending on the server's role and permissions.

Compliance Impact

This vulnerability could lead to unauthorized file access or code execution, potentially violating data protection requirements under GDPR or HIPAA. Organizations may face compliance breaches if sensitive data is exposed or modified due to the flaw.

Mitigation Strategies

Upgrade reportico-web to a version beyond 8.1.0 if available. If not, restrict write permissions to web directories and disable execute_mode=PREPARE in run.php. Block malicious POST requests via WAF rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart