CVE-2026-52609: Reportico-Web Reflected XSS Vulnerability

CVE-2026-52609 Overview

CVE-2026-52609 is a reflected cross-site scripting (XSS) vulnerability affecting reportico-web versions 8.1.0 and earlier. Attackers can execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that targets the reportico_criteria parameter combined with execute_mode=CRITERIA in run.php. The flaw is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, typically through a phishing link or embedded content that triggers the crafted request.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's session, enabling session hijacking, credential theft, and unauthorized actions within the Reportico application.

Affected Products

reportico-web versions 8.1.0 and earlier
Reportico open-source PHP reporting tool (run.php endpoint)
Web applications embedding vulnerable Reportico builds

Discovery Timeline

2026-08-18 - CVE-2026-52609 published to the National Vulnerability Database
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-52609

Vulnerability Analysis

The vulnerability resides in the run.php handler of reportico-web. When the endpoint is invoked with execute_mode=CRITERIA, the application reflects the value of the reportico_criteria parameter back into the rendered HTML response. The reflected content is not properly encoded or sanitized before being written to the output stream. This allows an attacker to inject HTML and JavaScript payloads that execute in the victim's browser.

Because the attack occurs through a crafted URL, exploitation depends on convincing an authenticated or unauthenticated user to click a malicious link. The XSS operates in a reflected pattern rather than persistent, so payloads do not survive across sessions in server storage. However, session cookies, CSRF tokens, and any DOM-accessible data within the origin remain exposed during execution.

The scope is marked as changed because injected script executes in the security context of the Reportico application origin, potentially affecting data outside the vulnerable component's own privilege boundary.

Root Cause

The root cause is missing output encoding on user-controlled query parameters. The reportico_criteria parameter flows from the HTTP request into the criteria-selection HTML view without contextual escaping. Any string containing characters such as <, >, ", or ' is treated as markup rather than data.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL of the form https://target/run.php?execute_mode=CRITERIA&reportico_criteria=<payload> and delivers it through phishing, chat, or a malicious redirect. When the victim loads the URL, the reflected payload executes in the browser under the Reportico application's origin.

The vulnerability requires no authentication, no privileges on the target, and no elevated attack complexity. Refer to the GitHub CVE-2026-52609 Research writeup for parameter-level details.

Detection Methods for CVE-2026-52609

Indicators of Compromise

HTTP requests to run.php containing execute_mode=CRITERIA combined with script-like content in the reportico_criteria parameter
Query strings containing URL-encoded <script>, onerror=, onload=, or javascript: sequences targeting Reportico endpoints
Referrer chains from external hosts leading to /run.php with unusually long or encoded query parameters

Detection Strategies

Deploy web application firewall rules that inspect the reportico_criteria parameter for HTML control characters and known XSS keywords
Correlate web server access logs with browser error telemetry to identify reflected payload execution attempts
Use signature-based detection against the specific parameter pair execute_mode=CRITERIA and reportico_criteria to flag suspicious activity

Monitoring Recommendations

Enable verbose access logging on the Reportico host and forward logs to a centralized analytics platform for retrospective search
Alert on outbound requests from browsers that follow Reportico page loads to unexpected external hosts, which may indicate token exfiltration
Track authentication anomalies, session reuse from new IP addresses, and rapid privilege changes following user visits to Reportico URLs

How to Mitigate CVE-2026-52609

Immediate Actions Required

Restrict access to the Reportico run.php endpoint to trusted internal networks or authenticated users through reverse-proxy controls
Deploy WAF rules that block reflected XSS patterns in the reportico_criteria parameter until an upstream fix is applied
Notify Reportico users to avoid clicking untrusted links referencing the application host

Patch Information

At the time of publication, no vendor advisory or fixed release is referenced in the NVD entry. Monitor the Reportico project on GitHub for updates beyond version 8.1.0 and apply patches as soon as they are published.

Workarounds

Disable the criteria-selection workflow by blocking requests where execute_mode=CRITERIA is present until a patch is available
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on pages served by Reportico
Set the HttpOnly and SameSite=Strict flags on session cookies to limit impact of reflected script execution

bash

# Example NGINX rule to block requests carrying script-like payloads to run.php
location = /run.php {
    if ($arg_execute_mode = "CRITERIA") {
        if ($arg_reportico_criteria ~* "(<|%3C)(script|img|svg|iframe)") {
            return 403;
        }
    }
    proxy_pass http://reportico_backend;
}