SysReptor Professional versions before 2026.61 allow authenticated users to upload image files that cause image processing to invoke Ghostscript with embedded PostScript code execution in a shared temporary directory. An attacker can exploit a race condition involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy malicious Python code into the application code directory. This injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is unaffected. Version 2026.58 includes a partial mitigation, and version 2026.61 fully resolves the vulnerability.

Successful exploitation allows an authenticated attacker to execute arbitrary code with the privileges of the SysReptor application process, potentially leading to full compromise of the application environment. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade SysReptor Professional to version 2026.61 or later to fully remediate this vulnerability. Version 2026.58 provides a partial mitigation but does not fully resolve the issue. No vendor advisory content is provided beyond this, so patch status is confirmed by the version information given.