CVE-2026-52607 in reportico
Summary
by MITRE • 08/18/2026
A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within Reportico, a PHP-based reporting tool, specifically affecting versions up to and including 8.1.0. This vulnerability is classified as a directory traversal issue, which fundamentally stems from insufficient validation or sanitization of user-supplied input parameters before they are processed by the server-side application logic. The specific vector for exploitation involves the run.php endpoint, where an attacker can manipulate two key parameters: target_format and execute_mode. By setting the execute_mode parameter to EXECUTE, the application enters a state where it attempts to process or render reports based on the specified format. However, when combined with a maliciously crafted filename in the target_format parameter, this configuration allows for unauthorized file system access.
From a technical perspective, the vulnerability exploits how the PHP interpreter handles file inclusion and execution paths. When an attacker specifies a path containing directory traversal sequences, such as dot-dot-slash characters, within the target_format field, the application fails to properly canonicalize or restrict these paths against a predefined whitelist of allowed directories. This lack of strict input validation enables the remote server to resolve the relative path into an absolute path outside the intended web root or report directory structure. Consequently, instead of rendering a legitimate report file in a supported format like PDF or Excel, the application may inadvertently include and execute arbitrary PHP files located elsewhere on the filesystem.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality, integrity, and availability of the underlying web server infrastructure. An attacker with network access to the Reportico instance can leverage this flaw to read sensitive configuration files, source code containing database credentials or API keys, and other proprietary data residing on the server. More critically, because the vulnerability allows for the execution of arbitrary PHP files, it facilitates remote code execution if an attacker can upload a malicious script to a writable directory accessible via traversal, or if they target existing executable scripts with known vulnerabilities. This effectively grants the attacker full control over the web application and potentially the underlying operating system, depending on the privileges under which the web server process operates.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this exploit technique corresponds to T1083, File and Directory Discovery, followed by T1059, Command and Scripting Interpreter, specifically when PHP code is executed remotely. The attack vector represents a classic example of how improper input validation on server-side parameters can lead to significant security breaches in web applications that handle file operations dynamically.
To mitigate this risk, immediate action should be taken to upgrade Reportico to the latest patched version where these path validation checks have been implemented by the developers. For environments where upgrading is not immediately feasible, a robust defense-in-depth strategy must be employed at the network and application levels. Web Application Firewalls can be configured with rulesets specifically designed to detect and block directory traversal patterns in URL parameters. Additionally, ensuring that the web server runs under a restricted user account with minimal file system permissions limits the potential damage of any successful exploitation attempt. It is also advisable to disable PHP execution in directories where report files are stored but should not contain executable scripts, thereby neutralizing the code execution aspect of this vulnerability even if directory traversal occurs.