External risk intelligence

Reportico Arbitrary File Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-52610

Reportico is a web-based reporting application. The vulnerability resides in a PHP endpoint ('run.php') used for report generation and template management, which is typically deployed as an internet-facing or intranet-facing web application component, making it likely to be reachable via standard web traffic.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in reportico-web, a reporting application, that could allow attackers to write or overwrite files on the server. This issue matters because unauthorized file manipulation can have significant consequences for system integrity and data security. The primary concern at this stage is to determine if our organization uses this specific software and is therefore exposed.

Attackers can write files anywhere on the server.
Matters if we use this reporting tool.
Confirm use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `run.php` endpoint of Reportico. This request would involve manipulating the `saveTemplate` parameter to include a path traversal sequence, combined with the `execute_mode=PREPARE` parameter. By doing so, an attacker can trick the application into writing files to arbitrary locations on the server, leveraging the web server's existing permissions.

No special access needed.
Submit crafted request to endpoint.
Write files anywhere on server.

Live Threat

Current exploitation, exposure, and threat context

Remote attackers could write or overwrite files on the system by exploiting a directory traversal vulnerability when saving report templates. This could impact system integrity and data confidentiality, depending on the web server's user permissions.

System files and templates at risk.
Directory traversal via file save parameters.
Arbitrary file creation or overwriting.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, the team responsible for the Reportico web application, likely the application or platform team, must first identify all instances of the affected software and determine their reachability and business criticality. This foundational step will enable a risk-based remediation plan, coordinating with the security team for exposure review and potentially the vendor management team if vendor-provided guidance or patches are required.

Application or Platform Team ownership.
Verify affected instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Reportico and how is it used?

Reportico is a web-based reporting application that allows users to create, design, and display interactive reports and dashboards. It is frequently integrated into web projects to provide data visualization features. The software functions as a server-side component that processes queries and generates output, meaning it often handles sensitive data and interacts directly with the server environment where it is hosted.

What does CVE-2026-52610 mean in plain English?

This CVE refers to a Path Traversal weakness, classified as CWE-22. It occurs when a program fails to properly sanitize user input, allowing an attacker to navigate outside the intended folder structure. In this specific case, the vulnerability enables an attacker to influence where the application saves files, potentially allowing them to overwrite critical system files or place new files anywhere the web server has permission to write.

How do attackers trigger this file write bug?

An attacker triggers this by sending a specifically crafted request to the run.php endpoint. The process requires setting the execute_mode parameter to PREPARE and manipulating the saveTemplate parameter to include path traversal characters like dot-dot-slash. Note that this attack does not require any prior authentication or special user privileges; however, it cannot write to locations where the web server user account lacks write permissions.

How relevant is this vulnerability to my environment?

The relevance depends on how your instance is deployed. According to Halo Surface Signal, because Reportico is a web-based reporting tool, it is often deployed as an internet-facing or intranet-facing component. If your Reportico instance is reachable via standard web traffic, it is likely accessible to remote attackers, increasing the risk that this vulnerability could be leveraged against your infrastructure.

What should I do if I run Reportico?

Your first step is to locate all instances of Reportico within your environment. Once identified, evaluate their network reachability and business criticality to prioritize your response. Review the software version in use to confirm if it is affected, and monitor official vendor channels for available patches or configuration guidance to secure the run.php endpoint against unauthorized template saving requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.