CVE-2026-61707

Name of the Vulnerable Software and Affected Versions SOCFortress CoPilot versions prior to 0.1.76

Description Low-privilege users with the customer user role can upload malicious case-report templates via the /case-report-template/upload endpoint. The system only validates the filename-derived MIME type and fails to validate the template content. Because templates are stored in a global store without customer code scoping, an attacker can replace legitimate default templates. When an administrator or analyst generates a report using the /api/incidents/report/generate-report-docx or /generate-report-pdf endpoints, the backend executes the attacker-controlled Jinja expressions as Python. This occurs because the render document with context function in backend/app/incidents/services/reports.py uses DocxTemplate without a sandbox, and the render html template function in backend/app/incidents/services/reports pdf.py uses a non-sandboxed Environment without autoescaping. In affected deployments, this allows for root-level remote code execution, exposing incident data, SIEM data, and stored connector credentials for all tenants. Additionally, the HTML/PDF renderer allows for local-file reads and requests to internal services.

Recommendations Update SOCFortress CoPilot to version 0.1.76.