Sysreptor
Monthly
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image formats that cause the platform's processing pipeline to invoke Ghostscript allow embedded PostScript to run inside a shared temporary directory, and a race against GnuPG configuration files created in temporary subdirectories makes GnuPG copy attacker-controlled Python into the application code directory, where it executes with the SysReptor process's privileges after the next worker restart. The Community edition is not affected, and exploitation requires a valid authenticated account plus a timing-sensitive race. Version 2026.58 provides only a partial mitigation and the issue is fully fixed in 2026.61; no public exploit code or confirmed active exploitation was identified at time of analysis, although the vendor rates this High at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while an independent assessment treats the race as AC:H.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata for any deployment running a version prior to 2026.55, because the public-share WebSocket consumer joins the same collaboration group as authenticated project members and forwards client-information, connect/disconnect, awareness, and deletion events without restricting them to the shared note subtree. This leaks project member usernames and display names plus the identifiers and live editing activity of notes that were never shared; note content itself stays protected and no write access is granted. Our reassessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), higher than the vendor-assigned 3.5 (PR:L/UI:R) because the metadata is returned to an unauthenticated share-link holder on connection, though exploitation still requires possession of a valid share link. There is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); the fix is included in release 2026.55 via commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1.
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Stored cross-site scripting in SysReptor prior to 2025.102 allows an authenticated user with file-upload permissions to plant malicious JavaScript that executes in the browser of any other logged-in user who later views the affected content - enabling session or credential theft and actions performed under the victim's identity. Exploitation is not remote-unauthenticated: it requires a valid account plus a separate victim who interacts with the stored payload (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4). There is no evidence of active exploitation or public exploit code, and EPSS is very low at 0.04% (13th percentile), so this is a moderate-priority issue centered on lateral movement and privilege escalation between application users rather than server compromise.
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image formats that cause the platform's processing pipeline to invoke Ghostscript allow embedded PostScript to run inside a shared temporary directory, and a race against GnuPG configuration files created in temporary subdirectories makes GnuPG copy attacker-controlled Python into the application code directory, where it executes with the SysReptor process's privileges after the next worker restart. The Community edition is not affected, and exploitation requires a valid authenticated account plus a timing-sensitive race. Version 2026.58 provides only a partial mitigation and the issue is fully fixed in 2026.61; no public exploit code or confirmed active exploitation was identified at time of analysis, although the vendor rates this High at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while an independent assessment treats the race as AC:H.
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. Fixed in 2026.58, with no public exploit identified at time of analysis; the CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) driving a HIGH rating on unauthenticated network reach plus high confidentiality and integrity impact, although an independent assessment rates attack complexity as High because the wildcard host configuration is a non-default production-hardening miss rather than a shipped default.
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an attacker who can plant a known, unauthenticated share-page session cookie in a victim's browser reuse that session after the victim enters the correct note password, gaining access to that shared note. The main SysReptor login is unaffected; only the 'publicshareinfo-auth' / 'sharednote-detail' share flow fails to rotate the session identifier on successful authentication (CWE-384). Exploitation requires a separate cookie-injection capability (for example an XSS vector, a shared or attacker-controlled device, or a network man-in-the-middle position) plus precise knowledge of the shared-note URL the victim will authenticate against, and the victim must actively submit the password, so the assessed CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis.
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-write note share link download an uploaded file or image from the same project by editing the shared note to reference the target asset filename. The shared-note authorization logic trusts that user-controlled reference and treats the asset as permitted, so the attacker can then retrieve it; the impact is confined to the project tied to the share link, filenames cannot be enumerated, and the attacker must already know the exact filename. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.68; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), which the independent assessment narrows to a confidentiality-only impact (C:L/I:N/A:N).
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata for any deployment running a version prior to 2026.55, because the public-share WebSocket consumer joins the same collaboration group as authenticated project members and forwards client-information, connect/disconnect, awareness, and deletion events without restricting them to the shared note subtree. This leaks project member usernames and display names plus the identifiers and live editing activity of notes that were never shared; note content itself stays protected and no write access is granted. Our reassessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), higher than the vendor-assigned 3.5 (PR:L/UI:R) because the metadata is returned to an unauthenticated share-link holder on connection, though exploitation still requires possession of a valid share link. There is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); the fix is included in release 2026.55 via commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1.
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Stored cross-site scripting in SysReptor prior to 2025.102 allows an authenticated user with file-upload permissions to plant malicious JavaScript that executes in the browser of any other logged-in user who later views the affected content - enabling session or credential theft and actions performed under the victim's identity. Exploitation is not remote-unauthenticated: it requires a valid account plus a separate victim who interacts with the stored payload (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4). There is no evidence of active exploitation or public exploit code, and EPSS is very low at 0.04% (13th percentile), so this is a moderate-priority issue centered on lateral movement and privilege escalation between application users rather than server compromise.
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.