CVE-2026-81180 in SysReptor
Summary
by MITRE • 09/18/2026
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within SysReptor Professional prior to version 2026.61 represents a sophisticated chain of attacks leveraging improper input validation and insecure temporary file handling mechanisms. As an authenticated user, the attacker is granted access to features that allow for the upload of image files intended for inclusion in pentest reports. The core technical flaw lies in how the application processes these uploaded images. Specifically, when certain image formats are encountered, the underlying image processing library invokes Ghostscript to handle conversion or rendering tasks. This invocation occurs within a shared temporary directory environment without sufficient isolation or validation of the content being processed by external binaries like Ghostscript.
This architectural decision creates an opportunity for PostScript injection. By uploading specially crafted image files that contain embedded malicious PostScript code, an attacker can exploit the way Ghostscript interprets these inputs. The vulnerability is not limited to a simple cross-site scripting or remote code execution via standard web vectors; it involves deeper system-level interactions. The injected PostScript operates within the context of the shared temporary directory, which serves as a common ground for various application processes and external tools invoked by the SysReptor backend workers. This lack of strict sandboxing allows the malicious payload to interact with other services running in or accessing this same space.
The exploitation path extends beyond Ghostscript itself through a race condition involving GnuPG configuration files located within temporary subdirectories. The attacker crafts the environment such that when specific conditions are met, the interaction between the image processing workflow and GnuPG operations leads to an unintended side effect. Specifically, the vulnerability allows for the copying of attacker-controlled Python code into the application's main code directory. This is achieved by manipulating file paths and timing during the execution of background tasks or worker processes that handle both image rendering and cryptographic operations. The race condition exploits the window where temporary files are created, modified, or linked before they can be securely isolated or deleted.
The operational impact of this vulnerability is severe, resulting in remote code execution with the privileges of the SysReptor application process. Once the malicious Python code is injected into the application directory and a worker restart occurs, the new instance loads the compromised modules. This grants the attacker full control over the server environment running SysReptor Professional. The consequences include potential data exfiltration, modification or deletion of critical pentest reports, lateral movement within the internal network if the server has access to other resources, and complete compromise of the confidentiality, integrity, and availability of the reporting platform. It is important to note that this vulnerability affects only the Professional edition; the Community edition does not contain the specific code paths or configurations required for this attack chain to succeed.
Mitigation strategies must focus on immediate patching and architectural hardening. The primary remediation is upgrading SysReptor Professional to version 2026.61, which fully resolves these issues by addressing both the Ghostscript invocation logic and the GnuPG race condition vulnerabilities. For environments where an upgrade is not immediately feasible, partial mitigations were introduced in version 2026.58, though reliance on this interim fix is discouraged due to its incomplete nature. Administrators should also enforce strict input validation for all uploaded files, ensuring that only expected image formats are processed and that any external binaries invoked during processing operate within a restricted sandbox with limited file system access. Implementing principle of least privilege for the application process can further reduce the impact if exploitation occurs by limiting what resources the compromised worker can access post-execution.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-377 Insecure Temporary File Creation. The use of shared temporary directories without proper isolation is characteristic of insecure file handling practices often cited in high-severity vulnerabilities. Furthermore, the exploitation technique involving race conditions to manipulate configuration files maps closely to ATT&CK techniques related to Defense Evasion and Privilege Escalation, specifically those involving process injection or component replacement within application directories. Understanding these mappings helps security teams prioritize remediation efforts based on established industry standards for vulnerability management and threat modeling.