CVE-2026-52607: Reportico-Web Path Traversal Flaw

CVE-2026-52607 Overview

CVE-2026-52607 is a directory traversal vulnerability in reportico-web versions 8.1.0 and earlier. The flaw resides in the run.php endpoint, where the target_format parameter fails to sanitize file path input. Remote attackers can supply crafted values to expose or execute arbitrary PHP files on the web server. Exploitation requires no authentication and can be triggered over the network by combining the target_format parameter with execute_mode=EXECUTE. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can read or execute arbitrary PHP files on the web server, leading to information disclosure and potential code execution paths through existing server-side scripts.

Affected Products

reportico-web versions <= 8.1.0
The run.php endpoint accepting the target_format parameter
Deployments using execute_mode=EXECUTE request handling

Discovery Timeline

2026-08-18 - CVE-2026-52607 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-52607

Vulnerability Analysis

The vulnerability affects the reportico-web reporting framework, an open-source PHP-based reporting tool. The run.php endpoint accepts a target_format parameter that determines output rendering. When combined with execute_mode=EXECUTE, the application uses this parameter value to reference a file on the local filesystem without normalizing traversal sequences. An attacker can supply relative path traversal sequences such as ../ to escape the intended directory and reference arbitrary PHP files. Because the referenced file is processed by the PHP interpreter, the impact extends beyond simple file disclosure to potential execution of any PHP file already present on the server.

Root Cause

The root cause is improper input validation on the target_format request parameter. The application does not enforce an allowlist of accepted output formats and does not canonicalize the resulting file path before include or require operations. This maps directly to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack is delivered over the network against the HTTP interface of a vulnerable reportico-web instance. No authentication or user interaction is required. An attacker issues a request to run.php with execute_mode=EXECUTE and a target_format value containing traversal sequences pointing to a PHP file on the host. The server resolves the path and processes the target file through the PHP runtime, exposing its contents or side effects. See the vulnerability research repository for reproduction details and the Reportico project for source context.

Detection Methods for CVE-2026-52607

Indicators of Compromise

HTTP requests to run.php containing the parameters execute_mode=EXECUTE and target_format= with traversal sequences such as ../ or URL-encoded %2e%2e%2f.
Access log entries referencing run.php with target_format values pointing to filenames outside the reportico output directory.
Unexpected PHP file access patterns originating from the web server user against paths outside the application webroot.

Detection Strategies

Inspect web server access logs and WAF telemetry for target_format parameter values containing path traversal characters or references to sensitive filenames like config.php or wp-config.php.
Correlate run.php requests with anomalous outbound activity or process spawning by the PHP-FPM or Apache worker process.
Deploy signature or regex rules in the reverse proxy or WAF to flag execute_mode=EXECUTE requests paired with non-alphanumeric characters in target_format.

Monitoring Recommendations

Enable verbose HTTP request logging for the reportico-web application and forward logs to a centralized analytics platform.
Alert on file access events where the PHP interpreter reads files outside expected reportico directories.
Track baseline traffic to run.php and flag statistical anomalies in request parameter shapes.

How to Mitigate CVE-2026-52607

Immediate Actions Required

Restrict network access to reportico-web instances until a fixed release is deployed, using firewall rules or reverse proxy allowlists.
Block requests to run.php where the target_format parameter contains path traversal characters or references file extensions other than expected report formats.
Audit the web server filesystem for sensitive PHP files reachable from the reportico application directory and relocate or restrict them.

Patch Information

No vendor patch reference is included in the current NVD entry. Monitor the Reportico GitHub repository for updates addressing versions after 8.1.0 and apply fixes as they become available.

Workarounds

Deploy a WAF rule that rejects HTTP requests to run.php when target_format contains ../, ..\, or URL-encoded equivalents.
Enforce PHP open_basedir restrictions to limit the directories the interpreter can access from the reportico application context.
Remove or disable the execute_mode=EXECUTE code path in deployments that do not require it.

bash

# Example nginx location block to restrict traversal patterns in target_format
location = /run.php {
    if ($arg_target_format ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}