SysReptor: Authenticated RCE by insecure image processing
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Syslifters | sysreptor | before 2026.61 | 2026.61 | Patch available | CNA |
- sysreptor VendorSyslifters Affected before 2026.61 Fixed in 2026.61 Patch available CNA
Remediation
- Fix · CNA sysreptor (Syslifters) Fixed in 2026.61
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81180
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
Other 7
- https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wmf3-gv8j-7qp7
- https://github.com/Syslifters/sysreptor/commit/7d800e5c737df0dbc3d4ea2d095c89235790a1cc
- https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea
- https://github.com/Syslifters/sysreptor/commit/e8bd31cb42a15a10bb5102337b55dde704be397f
- https://github.com/Syslifters/sysreptor/commit/f27760961943fb1716cbb68f2a6705e7251b4e5c
- https://github.com/Syslifters/sysreptor/commit/f5ad35b9e71d370b5e06ef4680979cb05c24ff3c
- https://github.com/Syslifters/sysreptor/releases/tag/2026.61
More Syslifters vulnerabilities
- TI-2025-37333 SysReptor Susceptible to Privilege Escalation by Authenticated Users CVSS 3.1HIGH 8.1
- TI-2024-23926 Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30… CVSS 3.1HIGH 8.8
- TI-2026-56077 SysReptor: Host header injection might allow account takeover CVSS 3.1HIGH 8.1
- TI-2025-40972 SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
- TI-2026-30602 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional CVSS 3.1MEDIUM 6.8
- TI-2026-56080 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes CVSS 3.1MEDIUM 4.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences