CVE-2026-81182: SysReptor Information Disclosure Vulnerability

CVE-2026-81182 Overview

CVE-2026-81182 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in SysReptor, a customizable pentest reporting platform developed by Syslifters. Versions prior to 2026.68 allow an unauthenticated attacker who holds a public read-write note share link to disclose uploaded files or images from the same project. The attacker updates the shared note to reference the target asset filename, causing the shared-note authorization logic to treat the asset as permitted. The attacker must know the asset filename, and the flaw does not permit cross-project access. The issue is fixed in SysReptor version 2026.68.

Critical Impact
Unauthenticated attackers holding a read-write shared note link can download arbitrary uploaded files or images belonging to the same project when they know the target filename.

Affected Products

SysReptor pentest reporting platform versions prior to 2026.68
Self-hosted SysReptor deployments exposing public read-write shared note links
SysReptor projects containing uploaded assets (files and images)

Discovery Timeline

2026-09-18 - CVE-2026-81182 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-81182

Vulnerability Analysis

The vulnerability resides in the authorization logic that governs how SysReptor shared notes reference project assets. A shared note is a collaborative surface that can be published through a read-write link without requiring authentication. When the shared note references an asset such as an uploaded file or image by filename, the authorization layer permits access based on that user-controlled reference rather than validating that the requester should have access to the underlying asset.

This is a classic Insecure Direct Object Reference pattern [CWE-639]. The application trusts the client-provided identifier and grants file download access based on that trust. An attacker with a read-write shared link and knowledge of an asset filename can enumerate and exfiltrate project files.

Root Cause

The shared-note authorization logic treats any asset referenced by the shared note as permitted content. Because the reference is user-controlled through the read-write share, an attacker can inject a reference to any asset filename in the same project. The fix in 2026.68 introduces an UPLOAD_RANDOMIZE_NAME setting that defaults to True, making filenames unpredictable and preventing enumeration.

Attack Vector

Exploitation requires network access to the SysReptor instance, a valid public read-write shared note link, and knowledge of the target filename within the same project. Cross-project access is not possible. The attacker modifies the shared note payload to reference the target asset, then downloads the asset through the shared note context.

python

# Security patch in api/src/sysreptor/conf/settings.py
# Introduces filename randomization to prevent asset enumeration
     's3': 'sysreptor.utils.storages.EncryptedS3Storage',
 }.get(UPLOADED_FILE_STORAGE, UPLOADED_FILE_STORAGE)
 
+UPLOAD_RANDOMIZE_NAME = config('UPLOAD_RANDOMIZE_NAME', default=True, cast=bool)
+
 ARCHIVED_FILE_STORAGE = config('ARCHIVED_FILE_STORAGE', default=DEFAULT_STORAGE)
 ARCHIVED_FILE_STORAGE = {
     'filesystem': 'sysreptor.utils.storages.UnencryptedFileSystemStorage',

Source: GitHub commit f730c3a

Detection Methods for CVE-2026-81182

Indicators of Compromise

Unauthenticated download requests to asset endpoints originating from sessions tied to shared note links
Repeated shared-note update operations that alter asset references shortly before file download requests
Access to project assets by clients that never authenticated to the SysReptor application

Detection Strategies

Correlate shared-note modification events with immediate asset download activity from the same client identifier
Alert on shared-note payloads that reference filenames not previously embedded by an authenticated project member
Baseline normal shared-link traffic per project and flag anomalous asset access volume from a single share token

Monitoring Recommendations

Enable verbose application logging on shared-note update and asset download endpoints in SysReptor
Forward SysReptor and reverse proxy access logs to a centralized SIEM for correlation with authentication events
Track the creation and lifetime of public read-write shared links and alert on links persisting beyond expected engagement windows

How to Mitigate CVE-2026-81182

Immediate Actions Required

Upgrade SysReptor to version 2026.68 or later, which contains the fix from GitHub Security Advisory GHSA-x3m3-v8pv-442r
Revoke existing public read-write shared note links for projects containing sensitive assets
Rotate or re-upload existing assets so that new randomized filenames are generated after the upgrade

Patch Information

The fix is available in SysReptor Release 2026.68. Relevant commits include 1b721e2, 1f3fd62, and f730c3a. The patch adds a UPLOAD_RANDOMIZE_NAME configuration option, defaulted to True, and tightens shared-note asset authorization.

Workarounds

Disable or restrict use of public read-write shared note links until the upgrade to 2026.68 is complete
Limit shared-note sharing to read-only where possible, since exploitation requires a read-write link
Restrict network access to the SysReptor instance using a VPN or IP allowlist to reduce unauthenticated exposure

bash

# Configuration example: enforce randomized upload filenames in SysReptor 2026.68+
# Add to the SysReptor environment configuration (e.g., app.env)
UPLOAD_RANDOMIZE_NAME=True