CVE-2026-52610

CVE-2026-52610 is a critical arbitrary file write in reportico-web (run.php) that exploits the interaction between two parameters: saveTemplate and execute_mode=PREPARE. Individually, each parameter represents legitimate functionality — PREPARE mode exists so users can preview report configurations before execution, and template saving is a valid workflow feature. Together, they create a vulnerability that bypasses any mental model of PREPARE as a sandboxed evaluation state. The technical severity (CVSS 9.1) is accurate, but the practical risk depends heavily on deployment context. Reportico-web is typically embedded within larger PHP applications — content management systems, internal tooling, financial reporting platforms. This changes the blast radius entirely. The vulnerability isn't just about writing an arbitrary file; it's about what the web server user context can already access: database credentials, session storage, configuration files, parent application code. An arbitrary file write as www-data with access to webroot becomes a credential harvesting mechanism first and an RCE enabler second. The EPSS of 0.0037 likely reflects detection lag rather than genuine rarity. Organizations running embedded PHP applications rarely have dedicated CVE monitoring for inherited dependencies — the security posture of the parent application determines whether this gets flagged. The population of unpatched, undetected instances is probably substantial. Immediate actions: Audit whether reportico-web runs in PREPARE mode with any user-accessible endpoint; verify the filesystem permissions of the web server user — specifically whether it has write access to directories containing credentials or configuration; treat any PREPARE-mode endpoint as potentially vulnerable regardless of apparent parameter usage; check for saveTemplate in access logs as an indicator of probing. The remediation priority isn't just patching — it's understanding whether the execution context already has lateral access to sensitive resources that makes this vulnerability far more severe than a standalone file write.

Reviewed through automated stages and approved by a human before publication.