EUVD-2026-83251Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
AV:N network-reachable share link; AC:H requires knowing exact filename; PR:L the read-write share link is a required low-privilege capability; C:L single same-project file disclosed; I:N/A:N note edit is mechanism not impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
AnalysisAI
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already possess a valid PUBLIC READ-WRITE note share link for the target project (a shareable capability, not a user account), AND to know the exact filename of the uploaded file or image being targeted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity authorization flaw (CWE-639, IDOR/BOLA) whose signals are mutually consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to SysReptor 2026.68, the release that fixes CVE-2026-81182 (https://github.com/Syslifters/sysreptor/releases/tag/2026.68; advisory https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image forma
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privile
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's em
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authentica
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an at
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata f
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remo
Share
External POC / Exploit Code
Leaving vuln.today