CVE-2026-52608 in Reportico
Summary
by MITRE • 08/18/2026
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Reportico versions prior to or equal to 8.1.0 represents a critical failure in server-side access control mechanisms, specifically targeting the handling of user-supplied input within the PreExecuteCode attribute. This flaw allows an unauthenticated attacker to bypass authentication requirements and inject arbitrary PHP code directly into the application's execution flow. The core technical issue stems from insufficient validation or sanitization of data passed through this specific parameter, which is intended for custom pre-execution logic but lacks proper safeguards against malicious payloads. Because the vulnerability exists at the access control layer rather than merely in input parsing, it effectively neutralizes security configurations such as PHP's safe_mode setting, rendering traditional server-side mitigations ineffective against this specific attack vector.
From a technical perspective, the exploitation of this flaw involves crafting HTTP requests that include specially formatted data within the PreExecuteCode field. When the application processes these reports without verifying the integrity or origin of the code snippet, it executes the injected PHP commands with the same privileges as the web server process. This leads to Remote Code Execution (RCE), granting the attacker full control over the underlying operating system depending on the permissions assigned to the web service account. The ability to execute arbitrary code means that attackers can perform a wide range of malicious activities, including but not limited to data exfiltration, installation of backdoors, pivoting to other systems within the network, and complete compromise of the host infrastructure.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as it involves unauthorized access leading to privilege escalation or code execution. Furthermore, in terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Initial Access via Web Application Exploitation and Execution through Command and Scripting Interpreter. The lack of authentication requirement places it squarely within unauthenticated attack scenarios, significantly lowering the barrier for exploitation by automated tools and opportunistic attackers scanning for vulnerable instances on the internet.
The operational impact is severe due to the direct path from web request to system-level compromise. Organizations relying on Reportico for business intelligence or reporting are at risk of total infrastructure loss if this vulnerability remains unpatched. The persistence of such a flaw in widely used open-source tools highlights the importance of rigorous code review and secure development lifecycle practices, particularly regarding how dynamic code execution features are exposed to end-users.
To mitigate this risk, immediate action is required to upgrade Reportico to version 8.1.1 or later, where these access control checks have been strengthened. In environments where upgrading is not immediately feasible, administrators should implement network-level controls such as web application firewalls that can detect and block requests containing suspicious PHP syntax in the PreExecuteCode parameter. Additionally, restricting direct internet exposure of Reportico instances to trusted IP ranges only provides a layer of defense-in-depth. Regular security audits and penetration testing focused on input validation and access control logic are essential to identify similar weaknesses before they can be exploited by malicious actors.