CVE-2026-52606 is a reflected XSS vulnerability affecting reportico-web versions <= 8.1.0. The vulnerability arises when an attacker includes a malicious script payload in the loadTemplate parameter while invoking run.php with execute_mode=PREPARE. This causes the injected JavaScript to be executed in the context of the victim's browser, potentially leading to session hijacking or other client-side attacks. No CVSS score or detailed vendor advisory is available, and no patch or remediation information has been provided.

Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the victim's browser, which can lead to theft of sensitive information, session hijacking, or other malicious client-side actions. The vulnerability is limited to reportico-web versions up to 8.1.0 and requires user interaction with a crafted URL or link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid interacting with untrusted links that invoke run.php with the execute_mode=PREPARE parameter and the loadTemplate parameter. Implementing web application firewall (WAF) rules to detect and block suspicious payloads targeting these parameters may provide temporary mitigation.