CVE-2026-52606: reportico-web XSS Vulnerability

CVE-2026-52606 Overview

CVE-2026-52606 is a reflected cross-site scripting (XSS) vulnerability in reportico-web versions 8.1.0 and earlier. The flaw exists in run.php, where the loadTemplate parameter is reflected into responses without sufficient output encoding when combined with execute_mode=PREPARE. Remote attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser context when clicked. Successful exploitation enables session theft, credential harvesting via injected forms, and unauthorized actions performed as the authenticated user. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user who clicks a crafted link, leading to session hijacking and account compromise in reportico-web deployments.

Affected Products

reportico-web versions <= 8.1.0
Applications embedding reportico-web reporting engine
Deployments exposing run.php to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-52606 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-52606

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the reportico-web reporting engine. The run.php entry point accepts a loadTemplate query parameter that specifies a template to load. When the request also includes execute_mode=PREPARE, the value of loadTemplate is reflected into the rendered HTML response without proper contextual escaping. An attacker who can induce a victim to click a crafted URL causes the victim's browser to execute attacker-controlled JavaScript in the origin of the vulnerable application.

The attack requires user interaction, but no authentication is needed to construct the payload. Because reportico-web is often embedded in reporting workflows accessed by authenticated business users, exploitation can pivot into session hijacking or actions performed as the victim. See the GitHub Vulnerability Research CVE-2026-52606 writeup for reproduction details.

Root Cause

The root cause is missing output encoding on the loadTemplate request parameter before insertion into the HTML response served by run.php. The execute_mode=PREPARE code path renders the template name into a page fragment without applying HTML entity encoding or context-aware sanitization. This lets attacker-supplied markup, including <script> tags and event-handler attributes, execute in the victim's browser.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to the vulnerable run.php endpoint containing a malicious payload in the loadTemplate parameter along with execute_mode=PREPARE. The attacker delivers the URL through phishing, malicious redirects, or embedded links. When the target loads the URL, the reflected payload runs in the origin of the reportico-web application, giving the attacker access to the victim's session cookies, DOM, and any privileged actions available to that session.

No verified proof-of-concept code is published with the CVE record. The vulnerability manifests in the request-handling flow of run.php when the PREPARE execute mode is invoked. Refer to the Reportico project repository for source-level context.

Detection Methods for CVE-2026-52606

Indicators of Compromise

Web server access logs showing requests to run.php with execute_mode=PREPARE and suspicious characters (<, >, ", script, onerror, onload) in the loadTemplate parameter.
URL-encoded XSS payloads such as %3Cscript%3E or %3Cimg%20src appearing in the loadTemplate query string.
Referer headers indicating that users arrived at run.php from external phishing domains.
Unexpected outbound requests from browser sessions to attacker-controlled hosts after users visit reportico-web URLs.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the loadTemplate parameter for HTML metacharacters and common XSS signatures.
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from reportico-web pages.
Alert on any HTTP request to run.php where loadTemplate contains characters outside an expected allowlist of template name characters.

Monitoring Recommendations

Ingest reportico-web access logs into a centralized SIEM for query-parameter anomaly detection.
Monitor authenticated user sessions for concurrent logins or sudden geolocation changes that may indicate stolen session tokens.
Track browser CSP violation reports for reportico-web origins and investigate spikes.

How to Mitigate CVE-2026-52606

Immediate Actions Required

Identify all reportico-web deployments at version 8.1.0 or earlier and restrict external access to run.php until a patched build is available.
Deploy WAF rules to block requests containing HTML metacharacters in the loadTemplate parameter.
Notify users of the reporting application to avoid clicking unsolicited reportico-web links.

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Monitor the Reportico project repository for a fixed release above version 8.1.0 and apply it as soon as it is available. Until then, treat run.php as untrusted input and place it behind additional filtering controls.

Workarounds

Implement server-side input validation that rejects any loadTemplate value containing characters outside [A-Za-z0-9_.-].
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set HttpOnly and Secure flags on session cookies to limit the impact of session token theft via XSS.
Restrict run.php access to authenticated internal networks or VPN clients where feasible.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in loadTemplate
SecRule ARGS:loadTemplate "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)" \
    "id:1052606,\
     phase:2,\
     deny,\
     status:403,\
     msg:'CVE-2026-52606 reportico-web reflected XSS attempt',\
     tag:'CWE-79'"