Syslifters
Monthly
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image formats that cause the platform's processing pipeline to invoke Ghostscript allow embedded PostScript to run inside a shared temporary directory, and a race against GnuPG configuration files created in temporary subdirectories makes GnuPG copy attacker-controlled Python into the application code directory, where it executes with the SysReptor process's privileges after the next worker restart. The Community edition is not affected, and exploitation requires a valid authenticated account plus a timing-sensitive race. Version 2026.58 provides only a partial mitigation and the issue is fully fixed in 2026.61; no public exploit code or confirmed active exploitation was identified at time of analysis, although the vendor rates this High at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while an independent assessment treats the race as AC:H.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image formats that cause the platform's processing pipeline to invoke Ghostscript allow embedded PostScript to run inside a shared temporary directory, and a race against GnuPG configuration files created in temporary subdirectories makes GnuPG copy attacker-controlled Python into the application code directory, where it executes with the SysReptor process's privileges after the next worker restart. The Community edition is not affected, and exploitation requires a valid authenticated account plus a timing-sensitive race. Version 2026.58 provides only a partial mitigation and the issue is fully fixed in 2026.61; no public exploit code or confirmed active exploitation was identified at time of analysis, although the vendor rates this High at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while an independent assessment treats the race as AC:H.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.