CVE-2026-52607

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1

Description A directory traversal issue allows remote attackers to expose or execute arbitrary PHP files on the web server. This occurs when a filename is specified in the target format parameter while using the execute mode=EXECUTE parameter at the 'run.php' endpoint. Directory traversal is a flaw that allows an attacker to access files and directories stored outside the web root folder.

Recommendations Update reportico-web to a version newer than 8.1.0. As a temporary mitigation, restrict access to the 'run.php' endpoint or avoid using the target format and execute mode parameters.