CVE-2026-52610: Reportico-Web Path Traversal Vulnerability

CVE-2026-52610 Overview

CVE-2026-52610 is an arbitrary file write vulnerability caused by directory traversal in reportico-web versions 8.1.0 and earlier. Remote unauthenticated attackers can create or overwrite files anywhere on the filesystem, constrained only by the permissions granted to the web server user. The flaw resides in the run.php endpoint, which accepts a user-controlled saveTemplate parameter when execute_mode=PREPARE is set. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An unauthenticated remote attacker can write arbitrary files to the host, enabling web shell deployment, configuration tampering, and full application compromise.

Affected Products

reportico-web versions <= 8.1.0
Web applications embedding the Reportico reporting engine
PHP deployments exposing the run.php endpoint to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-52610 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-52610

Vulnerability Analysis

Reportico is an open-source PHP reporting tool that renders and stores report templates through its web interface. The run.php endpoint exposes multiple execution modes controlled by the execute_mode HTTP parameter. When execute_mode=PREPARE is supplied, the application invokes the template save routine and writes content to a filename derived from the saveTemplate parameter.

The application fails to canonicalize or validate the supplied filename before passing it to the underlying file write operation. As a result, an attacker can inject path traversal sequences such as ../ or absolute paths to redirect the write outside the intended template directory. Because the endpoint does not require authentication in default deployments, exploitation requires only network reachability to the vulnerable PHP application.

The write operation runs under the identity of the web server user, typically www-data, apache, or nginx. Any directory writable by that user, including document roots, cron directories, or PHP session paths, becomes a target for attacker-controlled content.

Root Cause

The root cause is missing input sanitization on the saveTemplate parameter within the template preparation code path. The parameter value is concatenated into a file path without stripping traversal sequences, validating against an allowlist of characters, or confirming the resolved path stays within the templates directory.

Attack Vector

Exploitation requires a single HTTP request to run.php containing execute_mode=PREPARE alongside a saveTemplate parameter carrying a traversal payload and the desired file contents. Attackers commonly abuse this primitive to drop a PHP web shell into the web root, achieving remote code execution as the web server user. Additional post-exploitation options include overwriting .htaccess files, poisoning application configuration, or planting persistence via scheduled task files.

See the CVE-2026-52610 research repository for reproduction details and the Reportico project repository for source code context.

// Conceptual exploitation pattern - no verified PoC code available
// POST /run.php
//   execute_mode=PREPARE
//   saveTemplate=../../../../var/www/html/shell.php
//   [attacker-controlled template body containing PHP payload]

Detection Methods for CVE-2026-52610

Indicators of Compromise

HTTP requests to run.php containing both execute_mode=PREPARE and a saveTemplate parameter with traversal sequences (../, %2e%2e%2f, or absolute paths).
New or modified PHP files in the web root with recent timestamps that do not match deployment activity.
Unexpected files owned by the web server user in directories outside the Reportico templates path.
Outbound network connections initiated by the PHP process following a suspicious POST to run.php.

Detection Strategies

Inspect web server access logs for POST or GET requests to /run.php with saveTemplate values containing .., null bytes, or encoded traversal characters.
Enable PHP open_basedir violation logging to surface write attempts outside expected directories.
Monitor file integrity on the web root and application directories to identify writes not associated with a deployment pipeline.

Monitoring Recommendations

Alert on child processes spawned by the PHP-FPM or Apache process shortly after requests to run.php.
Correlate file creation events in web-accessible directories with the source IPs and user agents observed in access logs.
Track anomalous parameter lengths and content types on the run.php endpoint to catch payload delivery.

How to Mitigate CVE-2026-52610

Immediate Actions Required

Restrict network access to the Reportico run.php endpoint using firewall rules, reverse proxy allowlists, or authentication middleware.
Audit the web root and Reportico installation directory for unauthorized PHP files and remove any web shells.
Rotate credentials and API keys that may have been exposed to a file-write foothold on the affected host.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Consult the Reportico project repository for the latest release and commit history, and upgrade to a version later than 8.1.0 once a patched release is available.

Workarounds

Configure PHP open_basedir to constrain the reportico application to its own directory tree, blocking writes to arbitrary paths.
Place run.php behind an authenticated reverse proxy so that unauthenticated internet requests cannot reach the endpoint.
Deploy a web application firewall rule that rejects requests containing execute_mode=PREPARE combined with traversal characters in saveTemplate.
Run the web server as an unprivileged user with write access limited to a small, non-executable directory.

bash

# Example nginx rule blocking traversal in saveTemplate
if ($args ~* "saveTemplate=[^&]*(\.\./|%2e%2e)") {
    return 403;
}

# Example PHP open_basedir restriction in php.ini or vhost
php_admin_value open_basedir "/var/www/reportico/:/tmp/"