A critical vulnerability in SysReptor Professional allows authenticated attackers to achieve remote code execution, posing a severe risk of full system compromise.

The application fails to properly validate image uploads, allowing them to trigger Ghostscript processing in a shared temporary directory. An attacker can exploit a race condition during GnuPG configuration to inject and execute arbitrary Python code with the privileges of the application process.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server, leading to a complete compromise of the SysReptor platform. Given the platform's role in storing sensitive pentest reporting data, this could result in unauthorized access to highly confidential client information and potential lateral movement within the network. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade to SysReptor Professional version 2026.61 or later immediately to apply the necessary security fixes.

Proactive Monitoring: Review application logs for unusual file upload activity or unexpected worker service restarts, which may indicate exploitation attempts.

Compensating Controls: Restrict image upload functionality to trusted users only and ensure the application environment is hardened to prevent unauthorized access to temporary directories.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for SysReptor Professional deployments due to the potential for arbitrary code execution. Organizations are strongly advised to verify their current version and update to 2026.61 immediately. Failure to patch may expose the organization to total system compromise and the exfiltration of sensitive penetration testing documentation.