CVE-2026-52607: n/a
CVE-2026-52607 is a directory traversal vulnerability in reportico-web versions up to and including 8.1.0. It allows remote attackers to expose or execute arbitrary PHP files on the web server by manipulating the target_format parameter along with execute_mode=EXECUTE in the run.php endpoint. The vulnerability has a medium severity with a CVSS score of 6.5.
AI Analysis
Technical Summary
This vulnerability in reportico-web <= 8.1.0 enables remote attackers to perform directory traversal attacks via the target_format parameter combined with execute_mode=EXECUTE on the run.php endpoint. This can lead to exposure or execution of arbitrary PHP files on the affected web server, potentially compromising confidentiality and integrity.
Potential Impact
Successful exploitation can lead to limited confidentiality and integrity impacts by exposing or executing arbitrary PHP files on the server. There is no indication of availability impact. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the run.php endpoint and validate or sanitize input parameters to prevent directory traversal attacks.
CVE-2026-52607: n/a
Description
CVE-2026-52607 is a directory traversal vulnerability in reportico-web versions up to and including 8.1.0. It allows remote attackers to expose or execute arbitrary PHP files on the web server by manipulating the target_format parameter along with execute_mode=EXECUTE in the run.php endpoint. The vulnerability has a medium severity with a CVSS score of 6.5.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/reportico-web/reporticoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in reportico-web <= 8.1.0 enables remote attackers to perform directory traversal attacks via the target_format parameter combined with execute_mode=EXECUTE on the run.php endpoint. This can lead to exposure or execution of arbitrary PHP files on the affected web server, potentially compromising confidentiality and integrity.
Potential Impact
Successful exploitation can lead to limited confidentiality and integrity impacts by exposing or executing arbitrary PHP files on the server. There is no indication of availability impact. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the run.php endpoint and validate or sanitize input parameters to prevent directory traversal attacks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-06-08T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6a84980ec6e8be0332896e09
Added to database: 08/18/2026, 17:36:14 UTC
Last enriched: 09/11/2026, 21:18:03 UTC
Last updated: 10/02/2026, 02:46:05 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.