Security readout for executives and security teams
Plain-English summary
Reportico-web through version 8.1.0 may let an unauthenticated remote attacker create or overwrite files accessible to the web-service account. This could expose sensitive information or alter application and system files. The reported severity is critical, but the supplied sources do not establish active exploitation or confirm a patched release.
Executive priority
Treat as an urgent exposure-assessment and containment issue for internet-facing reportico-web. Prioritize discovery, restrict the affected endpoint, reduce filesystem permissions, and seek confirmed vendor remediation. Escalate immediately if an affected version is externally reachable without authentication or if unexpected file changes are found.
Technical view
CVE-2026-52610 is a CWE-22 directory-traversal vulnerability in reportico-web's run.php endpoint. A filename supplied through saveTemplate during PREPARE mode is reportedly insufficiently constrained, enabling arbitrary file writes within the web user's filesystem permissions. CVSS 3.1 is 9.1: network-accessible, low complexity, no privileges or interaction, with high confidentiality and integrity impact.
Likely exposure
Highest risk applies to reportico-web deployments through 8.1.0 where run.php is remotely reachable. Exposure depends on routing, authentication, endpoint restrictions, and the web account's write permissions. The bundle's structured affected-product metadata is unspecified, so organizations should verify installed software and version directly rather than relying on CPE inventory alone.
Exploitation context
The vulnerability description indicates remote, unauthenticated exploitation with low complexity. Successful abuse could create or overwrite files wherever the web user can write. No KEV listing or cited evidence in the supplied bundle establishes active exploitation. The sources also do not prove code execution, so that outcome should not be assumed.
Researcher notes
The CVE record reports versions through 8.1.0, but the bundle's structured vendor, product, version, and CPE fields are unspecified. No fixed version or official patch is identified. Validate implementation details against the referenced repository and research advisory, while avoiding assumptions about additional affected products, persistence, or code execution.
Mitigation direction
- Identify reportico-web deployments and determine whether versions are 8.1.0 or earlier.
- Restrict untrusted access to run.php while awaiting confirmed vendor remediation.
- Apply least-privilege filesystem permissions to the web-service account.
- Check Reportico guidance for a patched release or official mitigation.
- Monitor web and filesystem activity for unexpected template writes or overwritten files.
Validation and detection
- Confirm the installed reportico-web version from deployment records or package metadata.
- Determine whether run.php is reachable without authentication from untrusted networks.
- Review web-account write permissions and identify sensitive writable paths.
- Inspect logs for suspicious PREPARE requests involving saveTemplate.
- Check writable directories for unexpected, recently created, or modified files.
- Verify compensating controls block untrusted access without sending malicious payloads.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-52610 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/reportico-web/reporticoCVE reference, mitre
- https://github.com/kilotel/vulnerability-research/tree/main/CVE-2026-52610CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.