CVE-2026-52608

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1

Description An incorrect access control issue allows an unauthenticated attacker to inject arbitrary PHP code into the PreExecuteCode attribute of any report. This occurs regardless of the safe mode setting and can lead to remote code execution, which is the ability of an attacker to execute malicious commands on the host machine.

Recommendations Update reportico-web to a version newer than 8.1.0.