CyberRota Analysis
AI-GeneratedAuthenticated users of SysReptor Professional prior to version 2026.61 are vulnerable to a code injection flaw that allows attackers to exploit image file uploads to execute malicious Python code with the application's privileges. This vulnerability poses a high risk, as it can lead to unauthorized access and control over the application environment. Organizations using SysReptor Professional should prioritize upgrading to version 2026.61 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.