This vulnerability in reportico-web <= 8.1.0 enables unauthenticated remote attackers to specify arbitrary filenames via the "saveTemplate" parameter combined with the "execute_mode=PREPARE" parameter in the "run.php" endpoint, resulting in arbitrary file write or directory traversal. The exploit depends on the permissions of the web server user, potentially allowing overwriting or creation of files anywhere on the filesystem accessible to that user.

Successful exploitation can lead to arbitrary file creation or overwriting on the affected system, which may allow attackers to modify application behavior, inject malicious code, or disrupt service. The vulnerability has a CVSS score of 9.1 (critical), indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and parameters, and consider applying web application firewall rules to block suspicious requests targeting "saveTemplate" and "execute_mode=PREPARE" parameters.