CVE-2026-81180: SysReptor Professional Privilege Escalation

CVE-2026-81180 Overview

CVE-2026-81180 is a high-severity vulnerability in SysReptor Professional, a customizable penetration testing reporting platform. Authenticated users can upload image files whose formats trigger Ghostscript invocation during image processing. The embedded PostScript operates in a shared temporary directory, enabling an attacker to race GnuPG configuration file operations. The race condition causes GnuPG to copy attacker-controlled Python code into the application directory, where it executes with the SysReptor application process privileges after a worker restart. The Community edition is not affected. The vulnerability is classified as [CWE-20] Improper Input Validation and received a CVSS score of 8.8.

Critical Impact
Authenticated attackers can achieve remote code execution on SysReptor Professional instances by exploiting a race condition between Ghostscript PostScript processing and GnuPG temporary file handling.

Affected Products

SysReptor Professional versions prior to 2026.58
SysReptor Professional version 2026.58 (partial mitigation only)
SysReptor Community edition is not affected

Discovery Timeline

2026-09-18 - CVE-2026-81180 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-81180

Vulnerability Analysis

The vulnerability chains multiple weaknesses across image processing, cryptographic tooling, and application worker management. When an authenticated user uploads an image whose format triggers Ghostscript-backed processing, embedded PostScript executes with access to a shared temporary directory. The application also uses GnuPG for cryptographic operations, and GnuPG creates configuration and state files in temporary subdirectories.

An attacker times PostScript execution to interfere with GnuPG's file operations. By placing crafted files in predictable temporary paths, the attacker manipulates GnuPG into copying attacker-controlled Python code into the SysReptor application code directory. When a worker process restarts, Python imports load the malicious file, giving the attacker code execution with the privileges of the SysReptor application process.

Root Cause

The root cause is a combination of unrestricted Ghostscript invocation on user-supplied images and insufficient isolation of GnuPG temporary directories. GnuPG was invoked without hardened options, allowing external configuration files, network operations, and permissive behaviors that facilitated the file-copy primitive.

Attack Vector

Exploitation requires an authenticated account with image upload capability on a SysReptor Professional instance. The attacker uploads a crafted image that triggers PostScript execution via Ghostscript, then races GnuPG operations to plant a Python payload in the application directory.

python

# Patch: Hardening GnuPG invocation in api/src/sysreptor/utils/crypto/pgp.py
@contextmanager
def create_gpg():
    with tempfile.TemporaryDirectory() as d:
        gpg = gnupg.GPG(
            gnupghome=d,
            env={},
            options=[
                '--no-options',
                '--disable-dirmngr',
                '--no-auto-key-locate',
                '--no-auto-key-retrieve',
                '--no-auto-key-import',
                '--no-permission-warn',
            ],
        )
        gpg.encoding = 'utf-8'
        yield gpg

Source: Syslifters SysReptor commit 7d800e5

Detection Methods for CVE-2026-81180

Indicators of Compromise

Unexpected Python files appearing in the SysReptor application code directory, particularly after image upload activity
Ghostscript (gs) process invocations spawned from the SysReptor worker with unusual arguments or long-running PostScript execution
GnuPG temporary directories under the shared temp path containing unexpected configuration files during image processing
Worker process restarts followed by outbound network connections or shell activity from the SysReptor service account

Detection Strategies

Monitor file integrity of the SysReptor application code directory and alert on any new or modified .py files outside of deployment windows
Baseline the child processes of the SysReptor worker and alert on unexpected gs or gpg executions correlated with image uploads
Inspect audit logs for authenticated user image uploads followed shortly by worker restarts

Monitoring Recommendations

Enable process telemetry on SysReptor hosts to capture parent-child relationships between the application worker, Ghostscript, and GnuPG
Log and alert on write operations to Python module paths within the SysReptor installation directory
Track upload API calls with file type metadata and correlate anomalous formats with subsequent Ghostscript activity

How to Mitigate CVE-2026-81180

Immediate Actions Required

Upgrade SysReptor Professional to version 2026.61, which contains the full fix for CVE-2026-81180
If upgrading to 2026.61 is not immediately possible, apply version 2026.58 as an interim partial mitigation and prioritize the full upgrade
Audit the SysReptor application code directory for unauthorized Python files and rotate any secrets accessible to the worker process
Review authenticated user accounts and revoke access for accounts that are no longer required

Patch Information

The issue is fully resolved in SysReptor Release 2026.61. The fix includes hardening GnuPG invocation with restrictive options, removing Ghostscript from the Docker image, and eliminating the GHOSTSCRIPT_EXECUTABLE setting. Additional details are available in GitHub Security Advisory GHSA-wmf3-gv8j-7qp7.

Workarounds

Restrict image upload permissions to a minimal set of trusted authenticated users until the patch is applied
Remove or disable the Ghostscript binary on the SysReptor host to prevent PostScript execution during image processing
Ensure ALLOWED_HOSTS is explicitly configured to your domain names rather than left as a wildcard

bash

# Verify SysReptor version and upgrade to the patched release
docker compose pull
docker compose down
docker compose up -d

# Confirm Ghostscript is no longer present in the container
docker compose exec app which gs || echo "ghostscript not installed (expected)"